openai-responses

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow can enable the Web Search tool (tools: { web_search: { enabled: true } } / tools: [{ type: 'web_search' }]), which fetches public web content and injects the retrieved snippets/citations into the model’s context for the Responses API call.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly passes external MCP server URLs at runtime (e.g., https://mcp.stripe.com in the MCP integration examples) to the Responses API so the service will call those external servers to list/call tools, and those tool responses can directly influence agent behavior — meeting the criteria for a runtime external dependency that can control prompts/tools.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The documentation explicitly shows MCP integration with a Stripe-like endpoint and authorization token (example: server_url: 'https://mcp.stripe.com', authorization: process.env.STRIPE_OAUTH_TOKEN). That is a specific payment-gateway integration example (Stripe), which implies the skill can be used to perform direct financial operations via an external payment API. This meets the "payment gateways" criteria for Direct Financial Execution.