integration-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). At runtime, the generated webhook handlers ingest outsider-authored free text from the provider’s webhook HTTP body (e.g., rawBody = await request.text() then JSON.parse(rawBody) in app/api/webhook/<provider>/route.ts), which is attacker-controlled content from a third party.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment-integration generator for providers (Stripe, MercadoPago, Wompi, LemonSqueezy). Its templates and emitted plan include provider-specific financial operations: creating payment_intent / hosted checkout flows, billing portal sessions (billingPortal.sessions.create), a POST /api/refund endpoint for emitting refunds, webhook signature verification for payment events, and it pins/installs the Stripe SDK (stripe@^17). These are direct Payment Gateway integrations (create charges/payment intents, manage refunds, customer portal sessions) — not generic browser automation or generic HTTP tooling — and therefore grant the agent the ability to execute financial operations.