upwork-workflows

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Upwork workflow skill interacts with job postings, proposals, and messaging conversations where outsider-authored text (such as applicant proposals and client messages) is read and processed by the agent.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill orchestrates Upwork workflows that handle job postings, offers, contracts, and milestones, but explicitly states in SKILL.md line 69 that "Money movement and legally binding steps are never completed by this server. They return status: action_required and a finalize_url the user must open on Upwork." Since financial transactions are not directly executed by the server/agent (direct financial operations are offloaded to Upwork's external platform via a finalize URL), the operation is indirect.