person-lookup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow takes the outsider/user-provided --query free text and sends it as the POST body field {"query": "${query}"} to Clado’s POST https://clado.mpp.paywithlocus.com/clado/search (via the SELAT Router), which directly exposes the remote agent/data source to attacker-controlled natural-language input.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly uses selat-pay and the SELAT Router to settle each step as a capped payment (see "compiles the step into a selat-pay call", "Every step settles through the SELAT Router", per-step cap and live price, and probe/pay examples). It references resolving settlement from a funded Circle Gateway balance and shows a selat-pay POST example — i.e., it integrates a payment gateway/payment settlement mechanism and can execute paid transactions. This qualifies as direct financial execution capability.