backend-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow ingests client-provided free-form text (e.g., purchaseToken, productId, userId from the POST /purchases/verify request body) into the backend’s processing context, which can then be included in LLM context if the agent uses those fields in prompts—this is outsider-authored input because it originates from the untrusted client.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a backend for Google Play Billing and uses the Google Play Developer API to manage purchase state. It requires granting the service account "Financial data" and "Manage orders" and contains explicit calls that affect money/entitlements: purchases.subscriptionsv2.get, purchases.products.get, purchases.subscriptions.acknowledge, purchases.products.acknowledge, and purchases.products.consume. These are specific billing APIs that perform purchase acknowledgements/consumption and interact with order/financial state (i.e., can trigger refunds or grant/consume purchases), so this is direct financial execution capability.