pp-alaska-airlines

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill scrapes the public The Points Guy valuations page during the cash vs. points comparison workflow, which ingests external web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installation of an npm package and a Go module via URLs/locators (@mvanhorn/printing-press-library and github.com/mvanhorn/printing-press-library/...), which are personal third-party repositories representing a common/reputable unofficial operational dependency tier.