agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflows explicitly fetch and process open web and social content (e.g., Stage 11 "Fetch website homepage and key pages (HTTP Request)" and "Check social media", Stage 6 "Fetch full post content (RSS or HTTP Request)", and Stage 4 "Enrich — look up company website/LinkedIn"), which are untrusted third‑party sources that the agent reads and uses to drive scoring, synthesis, routing, and actions—creating a clear avenue for indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's Market Research and Content Repurposer workflows explicitly perform runtime HTTP requests to arbitrary external web pages (e.g., competitor or blog URLs such as https://{competitor-or-blog-url}/) and then inject that fetched content into Claude prompts for synthesis, meaning runtime-fetched external content directly controls the model input.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly integrates with payment gateways and contains functions to create/send invoices and manage subscriptions via Stripe. It references Stripe webhooks as triggers, n8n Stripe nodes, and the Stripe Invoice Flow with specific API endpoints (POST /v1/invoices, add line items, finalize, send, GET /v1/invoices/{id}), which are direct financial execution actions (creating/sending invoices and setting up subscriptions). These are specific payment gateway operations, so it grants direct financial execution capability.