ask-smart-booking-test

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to load credential files (config/identity.json, config/payment_cards.json) and use those email/password and sandbox card values to log in or inject into payment forms, which requires the model/agent to handle and reproduce secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's runtime workflow (SKILL.md "Execution (Browser Phase)" and the Test Case input in tests/case1.md) requires navigating to and inspecting arbitrary target URLs (e.g., https://example-flight-booking.com) and then reading page content to detect flows and payment gateways that directly drive actions, so it ingests untrusted third‑party web content that could inject instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly detects and interacts with payment gateways and contains concrete, payment-specific actions: it searches code for "stripe", "paypal", "razorpay"; inspects UI iframes/redirects; injects sandbox credentials (config/payment_cards.json) and a Stripe test card (4242...); logs into PayPal using stored identity creds; and simulates success for Razorpay/Square. These are specific, payment-gateway actions (not generic browser automation) and therefore constitute direct financial execution capability.