pp-bambu

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source is the Bambu Lab local LAN printer status/events that the CLI reads via its “events monitor”/“printer status”/“printer raw” hand-written runtime commands and then wraps output (including embedded 3MF/project/object titles and other text fields) into the agent-visible JSON provenance/results envelope; outsider-authored text could be present in those printer-side fields and is ingested at runtime without any “select a specific item” gating.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites explicitly run go install on remote Go modules (github.com/mvanhorn/printing-press-library/library/devices/bambu/cmd/bambu-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/devices/bambu/cmd/bambu-pp-mcp@latest), which fetches and executes remote code at install/runtime and are required for the skill to function.