paddle-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is the Next.js webhook POST route, which ingests Paddle’s webhook request body (await request.text()) and passes it to paddle.webhooks.unmarshal(rawBody, secret, signature); this body is outsider-authored free text (sent by Paddle, not the operating user), creating indirect prompt-injection risk if any fields are later included in LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly built around the Paddle payment gateway: it requires PADDLE_API_KEY, installs @paddle/paddle-node-sdk, creates a Paddle SDK instance, and references Paddle MCP methods (e.g., client.notificationSettings.create, client.notifications.replay, client.notifications.logs.list) and Paddle-specific operations like paddle.transactions.list(). It subscribes to and processes payment-related events (transaction.completed, subscription.*) and describes upserting transaction/subscription records and granting credits. Because it uses a specific payment provider's SDK and APIs (Paddle) rather than generic tooling, it meets the criteria for Direct Financial Execution authority.