canvas

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow ingests user-authored text and instructions submitted via the Renoise annotation board (revision intent, instructions, and local text notes) through tool calls like get_renoise_whiteboard_revision_intent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill describes creating tasks via Renoise MCP tools (estimate_cost, create_tasks) which estimate and charge for generated tasks (paid work). However, step 37 explicitly documents an independent execution control rule: "follow the Renoise tools' approval rule for paid work: show the complete final prompt in a fenced block with the model, type, resolution, duration/ratio, ordered material IDs and roles, estimated credits, and current balance, end the turn, and wait for the user's explicit approval." This workflow enforces human approval via the execution layer before a paid task can proceed. This constitutes qualifying independent approval/access-control gating for a direct financial operation, placing it at the medium tier.