convex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). This skill describes Convex function patterns but the only required runtime workflow present is user-provided webhook body ingestion via request.text() in an httpAction handler, which can include outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit payment gateway integration: an HTTP action route for "/webhooks/stripe" that parses Stripe webhook events and calls a payments mutation (ctx.runMutation(api.payments.handleWebhook)), and the Related Skills explicitly list @stripe (payment integration). This demonstrates the skill is specifically designed to handle payment gateway events and interact with payment-related logic, which qualifies as Direct Financial Execution authority under the rules.