base44

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses the Base44 MCP endpoint (POST https://app.base44.com/mcp with tools/list / tools/call), and the agent ingests the returned MCP tool descriptions/schemas (LLM-readable text) from Base44’s service, which is an outsider-authored source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.95). The MCP endpoint https://app.base44.com/mcp is invoked at runtime (e.g., tools/list and tools/call) and returns tool definitions and input schemas that directly control the agent's available tools and instructions, so it is a runtime external dependency that can alter agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The documentation explicitly exposes payment-gateway endpoints for Stripe (POST /api/apps/{app_id}/payments/stripe/install, GET /api/apps/{app_id}/payments/stripe/status, DELETE /api/apps/{app_id}/payments/stripe). These are specific payment gateway APIs (Stripe), which fall under Direct Financial Execution authority per the core rule.