deepapi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime can ingest outsider-authored text from user-driven scrape/search endpoints (e.g., POST /v1/scrape/website with attacker-supplied urls, and polling next.path to retrieve page content), and also reads outsider-authored email via GET /v1/email/messages for the user’s workspace.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit paid API endpoints that initiate runs which "may debit credits" and it requires/uses parameters like maxCostUsd / maxCostMicrousd and idempotency keys. The execution rules handle HTTP 402 insufficient_credits and instruct reporting debitMicrousd/costFinal. Because the agent can call these POST endpoints to start billable operations (and set spending caps), it can directly cause financial charges on the user's account — i.e., direct financial execution.