shopify-payments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow’s “Fetch live docs” step uses runtime web-search to retrieve public Shopify documentation pages, and those fetched pages are outsider-authored free text that can be ingested into the agent’s LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document explicitly describes APIs and mutations that perform financial actions: approving/declining payments (paymentSessionResolve/paymentSessionReject), redirects/confirmations for auth, capture/void session mutations (captureSessionResolve/captureSessionReject, voidSessionResolve), refund session and refundCreate (refundSessionResolve/refundSessionReject, refundCreate), and Billing API mutations that create charges/subscriptions/usage records (appSubscriptionCreate, appPurchaseOneTimeCreate, appUsageRecordCreate). These are specific, payment-focused operations (processing charges, captures, refunds, and creating billing charges) — i.e., direct financial execution capabilities.