iblai-vibe-monetization-subscription

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow for this skill renders the user-facing PurchasesTab, which ingests outsider-authored free text via the user-controlled search input and forwards it as the search query parameter to the backend (GET .../my-subscriptions/) without requiring prior selection of a specific item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements subscription management and cancellation flows, including a POST subscription cancel endpoint and an SDK mutation (useCancelSubscriptionMutation) that performs cancels. It also documents branching that creates a Stripe Customer Portal (portal_url) and triggers portal handoffs or immediate cancellation. These are specific payment-related APIs (subscription cancel, Stripe portal integration) — i.e., tools to move/manage money/subscriptions — so this grants direct financial execution authority.