spend-gate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow consumes outsider-authored free text from social media posts, videos, comments, and search results retrieved via proxy data read tools (TikTok, Instagram, YouTube, X, Reddit, etc.) without prior item selection.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents spending credits on marketing data, ads, and proxy reads using tools like marketing_data_lookup, gooseworks:data_call_provider, and gooseworks:automation_list. This constitutes a direct financial operation (charges/purchases of credits or paid data). However, the skill explicitly enforces human approval gates ("gets the human's yes before any credits are spent") prior to executing these paid operations, qualifying as an independent access control mechanism (human-in-the-loop authorization).