connect-recommend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 1c and references/company-researcher.md, the agent web-fetches and web-searches the user-supplied company URL/description, ingesting arbitrary third-party free text from those pages into the LLM at runtime (indirect prompt injection risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Company Researcher explicitly WebFetches the user-provided company homepage at runtime and uses the fetched page (e.g., the user-supplied URL like https://...) to extract facts that directly drive the agent's discovery and recommendation logic, so external content controls prompts and decisions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly focused on Stripe Connect (a payment gateway) and references Stripe-specific API operations and payment execution primitives (e.g., transfers.create, payouts.create, application_fee_amount, reverse_transfer, charge patterns, payout readiness). Although the skill is advisory (recommending configurations), it is specifically designed around a payment gateway and inspects/mentions concrete Stripe API calls and money-movement concepts, which qualifies as Direct Financial Execution authority per the rules.