terra-vantage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow includes processing inbound webhooks (order.status_changed and order_item.results_status_change) containing external data such as tracking numbers and failure causes submitted by third-party test suppliers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates with the Terra API Vantage platform for managing diagnostic test products, placing orders, processing kits, and handling lab results. Placing orders involves commercial transactions (purchasing test products/variants), making this a direct financial operation (purchases). Authentication is performed using standard Terra API credentials (dev-id and API key) via HTTP Basic or headers, which constitutes qualifying independent access control enforced by the service layer.