agency-payments-billing-engineer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow only handles provider-generated Stripe webhook payloads via the required handleStripeWebhook path, where it verifies signatures and deduplicates by event ID, but it does ingest LLM-readable free text from inbound webhook request bodies (outsider can submit arbitrary webhook POST bodies to the endpoint unless the signature secret is perfectly protected).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with payment gateways and contains code and directives to execute money-moving operations: it imports and uses the Stripe SDK to create PaymentIntents (including idempotency keys), handles webhook events to fulfill payments, and models subscription lifecycle transitions and reconciliation. These are specific, actionable financial execution capabilities (payment creation, subscription changes, payout reconciliation) rather than generic tooling.