one

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to set up webhook relays (from sources like GitHub, Airtable, Attio, Stripe, etc.) which automatically process incoming outsider-authored webhook payloads through Handlebars templates and forward them to external APIs.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill provides a CLI wrapper ("One CLI") that can execute API actions across 750+ third-party platforms, including commerce and payment services like Stripe (e.g., executing actions, processing webhooks, and chaining workflows). This constitutes a direct financial operation (charges, transfers, purchases via connected APIs). Although authentication is handled via browser login (one login), there is no independent access validation or authorization mechanism enforced at the payment/execution layer; authentication is session-based and managed entirely via stored API keys without independent service-side payment authorization checks on individual action execution routes.