ucp-checkout-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to "Fetch live spec" via web-search of site:ucp.dev and to fetch https://shopify.dev/docs/agents/checkout/mcp, meaning the agent will ingest and act on untrusted public web content (shopify.dev/ucp.dev) which can materially change its tool use and behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a checkout/payment integration: it defines MCP tools for create_checkout, update_checkout, complete_checkout (which takes payment_data and idempotency keys), and cancel_checkout, and explicitly references integrating with Shopify's MCP/checkout endpoints and OAuth2 auth flow. These are specific, purpose-built operations to initiate and complete financial transactions (payment gateway/checkout flows), not generic tooling. Therefore it grants direct financial execution capability.