zepto-prava-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to take Prava-returned secrets (Visa network token, cryptogram, expiry) and use them to fill the Zepto/Juspay payment form and create orders, which forces the LLM to receive and inject secret values verbatim into subsequent tool/browser-fill commands, creating an exfiltration risk even though it forbids printing them to chat.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow can ingest outsider-authored free text from the Zepto MCP server’s tool responses (e.g., list_saved_addresses, search_products, get_past_order_items) into the agent context via scripts/zepto-mcp-runner.mjs parsing result.content/result.structuredContent and printing it as JSON/text for the LLM to read.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill spawns mcp-remote at runtime pointed to https://mcp.zepto.co.in/mcp (e.g., via npx --yes mcp-remote https://mcp.zepto.co.in/mcp and scripts using endpoint "https://mcp.zepto.co.in/mcp"), which the agent connects to for tool calls whose returned content directly controls prompts/checkout actions and is required for the flow.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly creates Zepto/Juspay online payment orders, initiates Prava sessions to obtain tokenized card credentials, opens the payment link in a browser, fills the card form with the Prava token/cryptogram, and calls Zepto payment-status APIs. This is a specific, built-in flow to perform and confirm payments through a payment gateway (Zepto/Juspay) using tokenized card data, i.e., direct financial execution.