payment-assistant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests untrusted, user-provided QR data (from images, base64, clipboard, or raw QR strings) and then parses/uses that content to drive API calls and payment workflow (see SKILL.md QR handling: "When user sends a QR code image... --action decode_qr" and the code paths action_decode_qr/action_purchase which pass raw_qr into /binancepay/openapi/* parseQr and confirmPayment endpoints), so third‑party content can materially influence tool actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment processor. It includes named payment APIs/endpoints (e.g., /binancepay/.../confirmPayment, /binancepay/.../parseQr, /binancepay/.../queryPaymentStatus), CLI actions that perform transactions (purchase → pay_confirm → poll), automatic routing for C2C and PIX QR payments, wallet auto-deduction, and configuration requiring PAYMENT_API_KEY / PAYMENT_API_SECRET and a bpay.binanceapi.com base_url. These are specific, purpose-built financial operations (creating orders, confirming and submitting payments, checking limits, and polling final payment status), not generic tooling. Therefore it grants Direct Financial Execution Authority.