portaly-payment-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow consumes signed webhooks (callbacks) from Portaly Payment, which can contain outsider-authored text such as buyer names, notes, or metadata.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents instructions and code for creating hosted checkout sessions (POST /api/creator-subscription/checkout-sessions), which initiate payment processing for subscriptions. This is a direct financial operation (purchases/charges). The integration-scope key (pcs_test_itg_ / pcs_live_itg_) delegates authentication to the Portaly API via Bearer tokens checked server-side by the remote Portaly service, representing an independent authentication mechanism enforced by the service layer.