spree-payments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s required workflow includes “Fetch live docs” from public URLs (e.g., https://spreecommerce.org/docs/... and GitHub READMEs) and the LLM would ingest that fetched page text into its context, which is outsider-authored free text via runtime web fetching.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs fetching live documentation at runtime (e.g., https://spreecommerce.org/docs/developer/core-concepts/payments and the integration repo READMEs such as https://github.com/spree/spree_stripe and related spree_adyen / spree_paypal_checkout URLs), which the agent would load and use to determine prompts/implementation, so these are runtime external dependencies that directly control agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly and specifically about payment processing and gateway integration. It references and provides code for Stripe, Adyen, and PayPal integrations (including Stripe Connect for marketplace payouts), creating PaymentSessions that call gateway APIs (Payment Intents / Adyen sessions / PayPal orders), capturing payments, performing refunds via Spree::Refund.perform! which "hits the gateway's refund endpoint", and gateway methods like authorize, capture, void, and credit. It also instructs storing and using API keys and webhook endpoints. These are explicit financial execution capabilities (sending captures/refunds, marketplace payouts, authorizations) rather than generic tooling.