pp-ucp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path includes ucp-pp-cli check <domain> (and related discovery/search flows) which fetches /.well-known/ucp from an arbitrary user-supplied domain and ingests the resulting manifest text/JSON into the agent’s LLM context via --agent output.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a commerce CLI for UCP merchants: it exposes search, cart, and checkout flows (including "cart add" and a documented "checkout — POST /checkout" command and "checkout prep" for AP2 mandates). It also includes merchant-specific auth (per-merchant OAuth and signed requests). These are specific, purpose-built operations for creating/issuing checkouts against merchants (i.e., initiating purchases), not generic tooling. Therefore it grants direct financial execution capability.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)