start-an-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, user-authored strings are read into the app’s AI chat endpoint (src/app/api/chat/route.ts parses req.json() for messages) and are then sent to the model provider; this is direct ingestion from outsider-controlled free text at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs npx skills add against external GitHub repositories (e.g., https://github.com/shadcn-ui/ui), which are fetched/installed at runtime and supply the maintainer-published "skills" that the agent reads and follows, so these URLs are runtime dependencies that directly control agent instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly scaffolds payment processing and names payment providers (Polar and Stripe). It includes a dedicated "payments" branch/reference (references/payments.md), instructs setting up payment accounts in test mode and later swapping keys to go live, and mandates using Better Auth's payment plugin. These are explicit, specific instructions to integrate payment gateways — not generic tooling — and therefore provide direct financial execution capability.