medusa-storefront

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow explicitly fetches live public web content at runtime (e.g., https://docs.medusajs.com/... and site:github.com ...), and that fetched page text is outsider-authored and would be ingested into the agent’s LLM context for summarization/implementation guidance.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and use external documentation at runtime (e.g. https://docs.medusajs.com/resources/storefront-development and the medusajs nextjs-starter source on GitHub) to drive implementation and SDK prompts, so external content would directly control the agent's instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes checkout/payment-specific SDK methods and configuration: e.g., sdk.store.cart.initiatePaymentSession(), sdk.store.cart.complete(), and use of a publishable API key for payment-scoped Store API requests. These are specific payment/checkout operations (initiating payment sessions and completing orders) rather than generic HTTP or UI actions, so the skill is designed to perform financial transaction execution.