iblai-vibe-course-access

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow renders course-content UI by calling RTK Query hooks like useCourseDetail({ courseId, dmUrl, ... }) inside CourseContentLayout, which fetches course metadata/outline/completion/grading data that can originate from external edX/LMS content rather than trusted first-party text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly imports and references a Stripe checkout integration (useCreateStripeCheckoutSessionMutation, Stripe checkout redirects, and the Stripe success_url). Those are specific payment-gateway APIs that can initiate payment flows, so the skill grants direct financial execution capability.