pelecard-payment-gateway

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL’s required runtime workflow ingests outsider-authored callback free text (the PelecardStatusCode/ConfirmationKey/PelecardTransactionId payload delivered to ServerSideGoodFeedbackURL), then re-verifies it by calling POST https://gateway21.pelecard.biz/PaymentGW/GetTransaction server-side.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a Pelecard payment-gateway integration for accepting and managing card/Bit/ApplePay payments. It documents server-to-server API calls to create payment sessions (PaymentGW/init), charge stored tokens (IsToken/Token, recurring billing), perform captures (J5→capture) and refunds (DebitRegular cancel / refund endpoint), and requires merchant credentials (terminal/user/password) to execute those operations. These are specific payment APIs and flows that move money (and refund it), so the skill grants direct financial execution capability.