create-payment-credential

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow requires the agent to navigate and browse arbitrary merchant web pages and parse HTTP 402 responses and catalog data, exposing the model to outsider-authored free text from untrusted websites.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill provides operations to request payment credentials (cards, shared payment tokens, link pay tokens) and execute checkouts and payments via link-cli and ucp checkout complete. These actions constitute direct financial operations (purchases and payments). However, the workflow relies entirely on external app/user approval (e.g., via the Link app, as documented in lines 283–284 and 494) rather than independent service-layer access controls gating the CLI execution itself. Therefore, without qualifying independent access control on the direct operations, the severity is high.