inngest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests event payloads (e.g., handling webhook-style events like stripe/webhook.received and uploading/processing documents via document/uploaded) through an Inngest serve({ ... functions }) HTTP handler, where outsider-authored text can be posted into the event body and then passed into steps such as extractTextFromPDF(event.data.fileUrl) and chunking/embedding.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill includes explicit payment execution code and integrations: it calls stripe.charges.create to create a charge, defines a Stripe webhook handler (with idempotency) and references payment-related workflows. Those are specific payment gateway operations (Stripe) capable of moving money, so this grants Direct Financial Execution authority.