gocardless-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow for the skill’s webhook handlers ingests outsider-authored free text directly from incoming HTTP POST request bodies (GoCardless webhook payload) and parses them into events (after signature verification), so an outsider who can send requests to the endpoint can supply arbitrary JSON content for the LLM to ingest/handle.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for literal, high-entropy values that could be used as real credentials. The UUID-like string ED7D658C-D8EB-4941-948B-3973214F2D49 appears verbatim in multiple test files as the "GoCardless official public test vector" secret. Although documented as a test vector, it is a literal webhook secret (high-entropy) that can be used to reproduce valid signatures and therefore could be abused to forge webhooks if relied upon in a real environment — so I flag it.

Ignored items:

• "your_webhook_endpoint_secret" and the .env examples are documentation placeholders (ignored by policy).
• "test_webhook_secret" and similar test names are low-entropy test values / examples (ignored).
• Hex signature strings (e.g., 2693...e7e) are digests, not credentials, so not flagged.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about GoCardless, a payment gateway (bank-debit/recurring payments). It includes use of the GoCardless SDK (webhook parse/verification), environment variables for webhook secrets, and describes payment-related event types (payments confirmed/failed, payouts, refunds). This is a payment-gateway-specific integration (financial operations), so it meets the criteria for Direct Financial Execution authority.