procurement-offer-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads supplier offer files (docx, PDF) and external evaluation workbooks provided by third-party suppliers, ingesting outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill reviews supplier technical and financial offers, checks arithmetic (days × rate, VAT, ceilings), and propagates budget figures across internal procurement documents. These are indirect financial operations (reviews, calculations, and record keeping) with no direct money movement or delegated transactions. No direct payment routing or financial execution is performed.