complete-link-purchase

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow requires the agent to open and read arbitrary merchant checkout pages and API response bodies (Step 2 and Step 5), which are untrusted external sources of free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill performs direct purchases on merchant sites by retrieving and entering virtual payment cards issued via the Link wallet API. This constitutes a direct financial operation (purchases/charges). While the skill prompts the user to authorize a spend request via request_virtual_card and polls for approval, this client-side prompt and confirmation flow within the agent's interaction loop does not constitute an independent authentication or authorization mechanism enforced by the underlying service or execution layer (i.e., independent access control restricting the financial route). Therefore, it falls under the high severity tier.