agent-card

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to relay single-use payment URLs verbatim and to show full card PAN/CVV when requested, which forces the LLM to output secret sensitive values verbatim (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow involves reading arbitrary support-conversation content (outsider-authored free text from other participants) via the read_support_chat tool, which would then be ingested into the agent’s LLM context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes payment and money-moving operations: creating virtual Visa cards that spend wallet balance (create_card), funding the wallet via Apple Pay / Google Pay (fund_wallet), saving and managing payment methods via Stripe and starting Stripe Checkout (setup_payment_method, upgrade_plan), withdrawing wallet funds to bank accounts or as USDC on-chain (create_withdrawal_recipient, withdraw_wallet), and placing real purchases on behalf of the user (buy/pay_checkout). These are specific financial execution APIs (payment gateways, bank/withdrawal flows, and on-chain USDC withdrawals), not generic tools, so the skill grants direct financial execution authority.