saizeriya-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow involves scanning user-provided image files for QR codes using qr-scanner-cli, where the resulting QR URL or session data could contain outsider-authored text or instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates the saizeriya.js CLI which includes checkout and payment-related commands (account, receipt, submit) that initiate restaurant orders and payment flows (direct financial operations). Although instructions require human approval before execution, policy defines that internal agent instructions or confirmation flags do not establish qualifying independent access control enforced by the service or execution layer.