local-signal-pipeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly requires scraping and ingesting public third-party registries (e.g., "Public-registry scrapes (nadlan, county recorders, Companies House, MLS, permits)" and the SignalPlugin.fetch/normalize flow in the plugin contract), and those external records are read and used to drive the surround_orchestrator's channel decisions—so untrusted public content can materially influence agent actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes channel implementations like "MetaAdGeofence" and describes managing paid ad campaigns: "Direct ad budget paid by tenant to Meta/Google (we manage)". That indicates the system will create/run ads and manage tenants' ad spend (i.e., control/update ad budgets via Meta/Google integrations), which matches the listed "Managing Ad Spend (budgets)" criterion for Direct Financial Execution. It does not expose payment gateways, crypto, or banking APIs, but the explicit management of ad budgets is sufficient to flag risk.