hunt-business-logic

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow has the agent spider or fetch arbitrary target web pages, JS bundles, and sitemaps, and search GitHub and public sources, so outsider-authored text is consumed only after the agent actively selects it, which makes this low rather than medium.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill is a bug-hunting methodology, not an operator's payment workflow. Its documented actions still direct the agent to initiate payment instructions and payment callbacks against targets: step 4 says to intercept and tamper with payment flows and to attempt amount changes to $0.01, and the payload section includes a POST /payment/initiate with an altered amount and a fake success callback. Scenario 2 describes completing a real payment for $0.01. Because the skill offers this as an executable route to charge or credit, it is not excluded as illustration. This is a direct operation (payment initiation and settlement-affecting callbacks), not an indirect one. The skill establishes no independent authentication or authorization control for this route. The access checks it describes are the target's controls, which the methodology aims to bypass, and it does not document any qualifying control that it relies on. Under the control test, the direct operation therefore lacks established qualifying control, which yields High.