commercevault-edd-digital-commerce

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow connects to an Easy Digital Downloads store API to manage orders, products, and customers, ingesting API data that may contain user-submitted content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill includes an operational dependency on an unofficial third-party GitHub repository (dhapat3927/mcp-edd-analytics-vantage) cited for the middleware/tool installation, falling under common/reputable unofficial provenance at the medium tier.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill provides integration with the Easy Digital Downloads (EDD) REST API through CommerceVault middleware. It includes capabilities for creating orders, processing refunds, and managing payments via Stripe, which constitutes a specific payment gateway / financial execution mechanism.