pylot-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via conversation-triggered worker prompts/inputs (e.g., pylot workers prompt ... "<text>" and the conversation-based “admin-action” relay), where the LLM must process the user-provided message content at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit commands and API ops to set team/org budgets (e.g., pylot teams config <team> budget_daily_usd=600 and the budget-set confirm-tier admin action). These are concrete, purpose-built budget-modification operations (i.e., changing spend caps), not generic tooling. Because it includes the API/CLI to update budget values (with a confirm flow), it qualifies as direct financial execution authority.