nhcx-payer-payment

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow consumes v1/paymentnotice/request in C10-payment-enquiry.md and v1/paymentnotice/on_request in C11-payment-acknowledgement.md, which ingest outsider-submitted free text from external NHSX messages.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill's stated purpose is to guide the integration of NHCX payer-side payment features (raising and completing disbursements, sending payment notices and reconciliation, recording acknowledgements, and answering payment enquiries) into an existing payer claims platform. This involves designing and implementing payment notice, disbursement, and enquiry functionalities within a software system. However, the skill provides instructions and scaffolding for software development and integration rather than operating a live direct financial transfer or settlement execution itself. Since it defines indirect billing and disbursement integration routines without directly executing real-money money movement or transactions within the skill runner, this constitutes an indirect financial operation. According to the guidelines, indirect financial operations are evaluated at medium severity.