pp-cal-com

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow interacts with Cal.com calendar and booking data, which can contain user-submitted attendee names, emails, and notes from external bookers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references GitHub-hosted Go packages in its setup instructions (github.com/mvanhorn/printing-press-library/...) and an npm package (@mvanhorn/printing-press-library), which are personal/third-party unofficial repositories rather than recognized first-party publishers, constituting a medium-tier operational dependency.