square

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow connects to Square via Membrane API actions and proxy requests, which can ingest customer-facing data or inputs from Square records depending on runtime usage, but does not monitor an unselected inbound outsider channel by default.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installation of @membranehq/cli from npm at setup/runtime via npm install -g, which is an unofficial third-party registry transport for Membrane-hosted services lacking strong first-party verification.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation provides integration capabilities for Square, which is a payment gateway and e-commerce platform. It explicitly lists actions such as "Create Payment" (create-payment), "List Payments" (list-payments), "Create Invoice", and "Create Order", along with general API proxying to Square endpoints through the Membrane CLI. This grants the agent direct financial execution authority via payment processing APIs.