pay

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Pay’s runtime workflow ingests outsider-authored free text when it performs provider discovery/selection and then issues paid curl calls whose results include untrusted third-party response bodies, headers, and payment challenges that the LLM must read to proceed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). Agents load provider markdown and discovery data from the pay-skills registry at runtime (the markdown body is explicitly "loaded by agents after get_catalog_entry"), and that registry is hosted at https://github.com/solana-foundation/pay-skills, so remote content there can directly influence agent instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly implements payment functionality: it gives agents paid API access, prepares payments and requests local approval, and uses stablecoins as the settlement rail. MCP tools include a curl that "handle[s] 402 payment challenges with user-approved stablecoin payment" and a get_balance() for stablecoin balances. These are specific financial execution capabilities (crypto/stablecoin payments), so this grants direct financial execution authority (subject to local user approval).