pp-air-quality

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow invokes the air-quality-pp-cli binary, which (per the skill’s “When To Use”/recipes) fetches live OpenAQ/AirNow measurements from external services at runtime; those fetched pages/response bodies are outsider-authored free text that the CLI will pass back into the agent context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running a remote CLI that will be fetched and executed at setup/runtime (e.g., via "npx -y @mvanhorn/printing-press-library install air-quality --cli-only" and the Go install "github.com/mvanhorn/printing-press-library/library/other/air-quality/cmd/air-quality-pp-cli@latest"), so external code is downloaded and executed and is a required runtime dependency.