expense-wrangler

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow uses the Gmail connector to read message bodies and subjects, which can contain outsider-authored text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill extracts receipts from Gmail and prepares expense rows to log in trackers like Airtable, specifically noting that it does not pay invoices and is read-and-propose only (SKILL.md:3, 16, 26). This constitutes indirect financial operations (preparing billable/expense records), so the financial-security exposure is classified as medium.