customer-billing-ops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow ingests only provided billing identifiers (e.g., customer email/Stripe IDs/invoice IDs) and uses email/GitHub/issue trackers solely as supporting evidence, but the required runtime path described in SKILL.md does not specify reading arbitrary outsider-authored free text from those sources without first selecting specific known items.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for customer billing operations and instructs operators to use payment gateways (calls out "Stripe") and to perform billing actions such as refunds and cancellations ("refund only the affected charge or duplicate", "ACTION TAKEN
• refund / cancel ..."). These are specific payment gateway / transaction management operations, which constitute direct financial execution authority.