val-town

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow is described as user-authored HTTP/Webhook/Cron vals (e.g., StripeWebhook reads await req.text() and then parses JSON from the inbound request body), so outsider-authored free text can be injected directly into the handler without any prior item selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill imports and thereby fetches-and-executes a remote Deno module at runtime from "https://esm.town/v/std/sqlite", which is a required dependency that runs remote code in the skill environment.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a Stripe webhook handler (mentions "stripeWebhook", reads "stripe-signature", uses a STRIPE_WEBHOOK_SECRET, and handles "checkout.session.completed" events to trigger activation). This is a specific Payment Gateway integration (Stripe), not just a generic HTTP example, so it exposes direct financial-related execution capability (processing payment events and acting on them).