software-ios-native

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The only runtime workflow that ingests outside-authored free text is the example Cloudflare Worker /ai handler, which parses prompt: string from the request body and forwards it to an external LLM as-is.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Cloudflare Worker scaffold includes a runtime fetch that forwards prompts to the external LLM endpoint "https://api.example-llm.com/v1/messages" (assets/scaffolds/cloudflare-worker-backend.md), so the skill runs external network-hosted model inference that directly controls agent output at runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill explicitly documents StoreKit/billing integration and in-app purchase operations (StoreKit 2 subscriptions, Product.purchase(options:), Transaction.updates / transaction.finish()), and even mentions bridging Stripe credits for Apple-billed users. Those are concrete, finance-related APIs for executing/finishing purchases and managing subscription transactions — i.e., direct financial execution capabilities.