paddle-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to build a webhook receiver endpoint that ingests external webhook events from Paddle, which are outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides instructions and code for receiving and verifying Paddle webhooks in a Next.js Route Handler. It processes incoming notification events (such as subscription changes, transactions, customer updates) and syncs them to a database. Handling incoming webhooks about payment/subscription events is categorized as indirect financial operations (receiving/processing billing state changes and billable events for downstream handling), which falls under the medium severity tier.