subscription-recovery

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow instructs the agent to browse arbitrary external subscription web pages and user-provided URLs in Phase 1 and Phase 3, exposing the agent to low-risk indirect prompt injection from outsider-authored web content.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill audits and cancels subscriptions and requests refunds or goodwill credits (SKILL.md:3, 88-112). These actions constitute direct financial operations (canceling recurring charges and requesting refunds/disputes). Because these actions are performed via browser automation using the user's existing authenticated sessions without independent service-layer access validation enforced on the payment route, it represents a direct financial operation without qualifying independent control.