spree-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s required workflow is to fetch public web pages/README content (e.g., spreecommerce.org docs and GitHub repo READMEs/releases) at runtime; that fetched free-form text can be ingested into the agent’s LLM context, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime commands that fetch and execute remote code—e.g., "npx create-spree-app@latest" and "git clone https://github.com/spree/spree-starter" (and "git clone https://github.com/spree/storefront") which pull repositories/packages that are then executed via bin/setup, npm scripts, docker-compose, etc., so these URLs represent runtime-executed external dependencies.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The documentation explicitly references payment gateway integrations (Stripe via spree_stripe, Adyen, PayPal via spree_paypal_checkout), notes default payment methods created by the installer, and mentions publishable API keys (NEXT_PUBLIC_SPREE_PUBLISHABLE_KEY) coming from the Spree admin. These are specific payment gateway integrations (not generic browser or HTTP tooling) and indicate the skill is intended to enable processing payments via those providers.