create-payment-credential

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow instructs the agent to browse arbitrary merchant websites and ingest their page contents and API responses, which can contain outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents tools to obtain payment credentials (cards, tokens) and complete purchases via Link and UCP checkout commands, representing direct payment operations. However, no independent access control is documented for these payment routes; the instructions rely entirely on the agent or user operating the CLI interface without an independent service-enforced validation layer described in the prompt.