halo-cli-shop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required shop workflow reads order lists and order details (halo shop order list / order get), which include customer-entered free text such as order notes and addresses. Customers can place orders through guest checkout, so an outsider can add content to a feed the agent reads without the agent selecting a specific item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). Decisive operation: the skill lets the agent create real customer orders (halo shop order create --username ... --item ..., with an order payload that includes customPrice), which is creating a real bill for a customer. That is an indirect financial operation, so no access-control test applies. No direct operation is documented: the skill does not document transfers, charges, refunds, purchases, or trades. order mark-paid only records payment status, and config set --group payment changes shop configuration rather than sending a payment instruction. These do not change the tier because the indirect order creation already sets Medium. The skill also does not document any payment-gateway authority that would make it a direct operation.