firstsales

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The FirstSales agent reads campaign reply inboxes, email threads, and lead signals which ingest outsider-authored free text from outbound prospects.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates a CLI tool (FirstSales) for outbound sales campaigns, contacts, and billing/usage checks. Although billing management is mentioned (e.g., checking credits and mentions of "Top up or check out" in SKILL.md:76), authentication requires user-managed API keys via firstsales auth status and firstsales whoami (SKILL.md:30-34), and all write operations require explicit dry-run previews and user confirmation (SKILL.md:61). No direct financial operations such as initiating payments, transfers, or trades are performed directly by the agent without user authorization and service-level API credentials.