portaly-product

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow consumes signed webhooks via HTTP POST requests sent to the user's callback URL, which can be triggered with outsider-authored free text in event payloads.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation describes integration with Portaly digital products checkout via an API. It mentions creating checkout sessions and handling webhooks for payments, refunds, and failures. However, according to the instructions, payment gateways (like Portaly checkout integration APIs) are explicitly flagged under Risk 1 as Direct Financial Execution tools ("Payment Gateways (Stripe, PayPal, etc.)"). Therefore, the presence of specific checkout session creation APIs and payment gateway callback handling classifies this skill as having Direct Financial Execution capability.