mpp-conformance

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow explicitly fetches live public web pages at runtime (e.g., https://paymentauth.org/, IETF draft URL, and Stripe docs via web search), and those fetched free-form page contents can be ingested into the agent’s LLM context, creating an outsider prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching live docs at runtime (e.g., https://paymentauth.org/ and https://datatracker.ietf.org/doc/draft-ryan-httpauth-payment/) and then requires using that fetched specification to determine conformance requirements, meaning remote content would directly control the agent's instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document is specifically about implementing and operating a payment protocol: it explicitly references payment gateways and methods (Stripe, Stripe API keys, SPT handling), crypto/blockchain details (Tempo chain ID 4217, USDC contract address, recipient, wallet keys), headers for payment authorization and receipts, payment verification, refund process, and monitoring of payment provider availability. These are specific, payment-focused capabilities (not generic tooling) and indicate direct financial execution/handling responsibilities.