agent-card

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to relay single-use payment links verbatim and to (when asked/approved) output full card PAN/CVV values, which forces the LLM to include sensitive secret values directly in its outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text can enter the agent via the user’s own natural-language “buy” order request, which the workflow then uses within the conversational checkout flow (passing user text into the buy tool via conversation_id).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires connecting to the remote MCP server at https://mcp.agentcard.sh/mcp during runtime (for tool calls and to fetch evolving guides like get_instructions), so this URL is a runtime dependency that can change or control agent prompts/behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly exposes financial execution capabilities: it can create and fund virtual Visa cards that spend the user's wallet balance (create_card), accept funding via Apple Pay / Google Pay (add_funds), manage Stripe payment methods (setup_payment_method / remove_payment_method / list_payment_methods / set_default_payment_method), place real purchases/checkout with buy, and withdraw funds to a saved bank account or as USDC (create_withdrawal_recipient / withdraw). These are specific payment and banking operations (moving money and controlling payment instruments), not generic tooling.