pp-booksy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs copying a live x-access-token into a CLI command (booksy-pp-cli auth set-token <token>) and shows playbook slot substitution with a "", which requires the agent to handle and potentially emit secret tokens verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow is the Booksy “Automatic learning” loop (notably recall "<user's question>" --agent, which is a user-authored free-text string ingested and then used to drive subsequent tool/learning behavior), making outsider prompt injection possible via the user’s question.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs installing and running code fetched from external sources — e.g., "go install github.com/mvanhorn/printing-press-library/library/commerce/booksy/cmd/booksy-pp-cli@latest" and the MCP install "go install github.com/mvanhorn/printing-press-library/library/commerce/booksy/cmd/booksy-pp-mcp@latest" (and the npx installer "@mvanhorn/printing-press-library" at line 15) which fetch and execute remote code and are required for the skill to run.