shop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow uses the shop CLI to fetch and ingest merchant/product data (e.g., product titles/descriptions, ratings, and URLs) from Shopify catalog/MCP responses into the agent’s LLM context, which is outsider-authored free text (merchant-supplied product copy) via the catalog MCP/search/get_product response handling.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit checkout/payment commands and flows: shop checkout create/update/complete (including feeding merchant-issued payment instrument ids and tokens into shop checkout complete --confirm), delegated-budget checkout with payment.instruments present, and auth/budget commands for delegated spend. These are specific, purpose-built payment operations (creating and completing purchases, using payment tokens/instruments, and managing a delegated spending budget), not generic tooling. Therefore the skill grants direct financial execution authority.