omh-spend-gate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow reads quotes, receipts, and checkout or 402 challenge text from merchant or payee pages the agent must actively fetch or select, which are arbitrary outsider-controllable web sources with no unsolicited submission queue, so this is low.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). Decisive operation: the skill governs direct money movement. It covers card checkouts, HTTP 402 pay-per-request calls, wallet transfers, bookings, and paid data endpoints. Its example retries a 402 call "with a credential" and pays "through the client they installed" (lines 40-41), and its scope says "Use before the agent moves money on any rail" (line 71). Money moves through the person's own payment surface after the agent gets a typed confirmation (line 96). This is a direct operation, not indirect.

Control: no qualifying control is established. The only gates are the agent-followed pre-spend card, the typed yes in session, an optional host approval prompt, and the optional clarify or browser_vault re-ask (lines 52-53, 87-88, 122). These are instructions the agent is told to follow. The skill does not describe a service- or execution-layer authentication or authorization check that enforces the payment route. The cap is also agent-tracked metadata (lines 90, 118), which does not count as access control. Per the rules, agent-followed confirmation and spending limits do not establish independent access validation, so the direct operation lacks a qualifying control and rates High.