handle-saas-billing-cases

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). SKILL.md:9-20 and 131-134 require reading the complete live customer email/support thread and drafts, meaning runtime outsider-authored free text from the customer is ingested into the agent context for case resolution.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly defines and permits provider-side financial mutations: cancellations, refunds, voids, creating refunds, canceling payment intents, stopping provider retries, and related invoice/charge actions. It requires explicit approval for exact financial actions but the documented flows and approval gates (e.g., void invoice, cancel payment intent, create refund, cancel subscription then refund) show this skill is specifically designed to perform direct financial operations with payment providers.