pp-printing-press-golden

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that substitute/play back slot values (including a "token" in slots_resolved) and explicitly shows passing a token as a CLI argument (auth set-token ), which would require the agent/LLM to insert secret values verbatim into generated commands—an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes a GitHub release URL that the README explicitly points to for downloading pre-built binaries (a common vector for distributing executables) and an obviously suspicious host (evil.example.com); these are potential malware distribution sources unless you trust and verify the publisher and release assets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow is the CLI agent “self-learning loop” in SKILL.md, where the agent reads and executes recall output fields like candidates, playbook.steps, and playbook.notes that originate from the local store’s previously recorded sessions rather than from first-party/trusted provider text; because outsider user questions can be submitted to the skill, the agent can later ingest attacker-authored free text via those stored learnings/playbooks without selecting a specific item first.