agentic-payments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow instructs the agent to inspect URLs and pay HTTP 402-protected resources supplied by external sources/users, ingesting untrusted free text in response bodies and challenge headers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to download and execute an external shell script from https://inflowcli.ai/install.sh and a PowerShell script from https://inflowcli.ai/install.ps1 at runtime, constituting a weak/unknown/suspicious external operational dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents operations for paying HTTP 402-protected resources using MPP and x402 via the inflow CLI, constituting direct financial operations (purchases/settlements). These direct operations require authentication with an encrypted local vault (inflow auth login and inflow vault unlock) and human approval in the InFlow app via an approval URL and approval_id for every transaction, establishing independent access controls and authentication. Therefore, the exposure level is medium.