truto-unified-mappings

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow reads API documentation URLs and local documentation files via --source-url, which are low-risk outsider- or user-supplied sources fetched during the build process.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs downloading and executing installation scripts from cli.truto.one (https://cli.truto.one/install.sh and https://cli.truto.one/install.ps1), which constitutes an external operational runtime dependency with domain-ownership publisher provenance (common/reputable unofficial tier).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents a CLI tool for generating, validating, and applying JSONata mapping configurations that connect proxy APIs to unified models on the Truto platform. While it includes configuration commands and data-plane application (truto unified-mappings apply), service configuration, API key management, and data mapping/sync synchronization do not constitute direct financial transfers, charges, purchases, or trades. Therefore, this represents an indirect workflow.