pricewin-booking-assistant

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly requires the agent to accept a user-provided cancelToken (magic link) and then include that token verbatim in the cancel_booking call (and also passes user emails/other PII verbatim), which forces the LLM to handle and output secrets/tokens directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the agent forwards the user's verbatim free text as queryText into pricewin tool calls (e.g., create_booking and potentially hotel detail/OTA detail), meaning outsider-authored text is ingested by the workflow without any requirement to select a specific provider item first.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs payment-related operations: it "creates bookings and payment links", defines and requires a paymentMethod (SEPAY, POLAR, PAYPAL), and instructs calling create_booking which returns a payment link and confirmationCode. It also exposes functions to check payment status, recreate payment links, and cancel bookings—i.e., specific APIs for initiating and managing real-money transactions.