customer-billing-ops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to use email, GitHub, or issue trackers as supporting evidence when investigating customer billing issues, which exposes it to outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references connected billing tools like Stripe (Lines 3, 24) and involves executing revenue-impacting operations such as issuing refunds and canceling subscriptions (Lines 3, 78, 128), which falls under Direct Financial Execution via payment gateway integrations.