amazon-returns-recovery

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow directs the agent to interact with Amazon's live support chat and ingest real-time outsider-authored text (support associate responses and chat messages), exposing the benign agent to indirect prompt injection.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates an Amazon returns and subscription recovery assistant that audits accounts and drives live chat/cancellations to request waivers and refunds (direct financial operations: charges, refunds, purchases/cancellations). However, execution relies entirely on instruction-based gating ("Iron Law" and user confirmation) rather than independent, service-enforced authentication or authorization checks on the payment/dispute routes themselves.