pp-airhint

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow is executing airhint-pp-cli ... --agent, which fetches live flight/price data from AirHint’s HTTP REST endpoints and ingests the returned JSON into the agent context; this is outsider-authored free text/data from a third-party web API response.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite installation steps run remote installers that fetch and execute code at runtime — e.g. "npx -y @mvanhorn/printing-press-library install airhint --cli-only" (npm package fetch/execute) and "go install github.com/mvanhorn/printing-press-library/library/travel/airhint/cmd/airhint-pp-cli@latest" (fetches and builds remote Go code), so external content would be executed to provide the required CLI.