accounts-payable

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow is described as capturing bills from an inbox (e.g., forwarding to bills@yourcompany.com) and extracting free-form content from PDFs/images at runtime, which would include outsider-authored invoice text from vendors.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references automated payment execution and integrations with payment/banking platforms. It mentions templates that perform "weekly ACH pay runs" and "monthly payouts," auto-approve-auto-pay (touchless recurring bills), and "ACH/check/card pay runs." It names payment platforms (Bill.com, Ramp Bill Pay, Melio, Stripe, Mercury) and describes a Proto agent handling "payment scheduling." These are specific payment execution capabilities (sending ACH/card/check payouts and integration with bill-pay services), so this grants Direct Financial Execution Authority.