ucp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow reads catalog search results and merchant responses from external UCP-supporting merchants via the UCP CLI, where an outsider could publish product or merchant data.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents direct checkout completion operations via the ucp checkout complete command (e.g., lines 212-218) and related purchase workflows, which constitute a direct financial operation (purchases/settlement authorization). However, the skill provides no documented independent authentication or authorization mechanism enforced by the service or execution layer for these direct payment routes; access control is unestablished.