bill-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 运行时在 components/bill-list-card/index.js 与 components/pay-result-card/index.js 里把来自 modelCtx.on(NotificationType.Result) 的 structuredContent（账单/支付记录文本字段）直接写入卡片展示与后续 api/call 工作流，且该结构化内容可被外部用户触发的上游结果影响（属于可通过队列/上下文注入的间接自由文本）。

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly provides a payment API: "payBill：基于 billId 完成单笔账单支付" and describes calling payBill to complete user-initiated payments. This is a specific capability to execute financial transactions (bill payments), not a generic tool, so it constitutes direct financial execution authority.