pp-context-dev

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill documentation shows a command that requires embedding a token directly on the command line (context-dev-pp-cli auth set-token YOUR_TOKEN_HERE) and describes storing secrets in credentials files, which encourages the LLM or an agent to output or handle secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes an agent-mode CLI that will scrape/crawl/search and extract from caller-supplied URLs and also supports website search results (e.g., scrape, crawl, extract, web create-search), so outsider-authored free text can be ingested at runtime via those URL/seed inputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing a remote CLI via installer commands that fetch and execute code at runtime (e.g., go install github.com/mvanhorn/printing-press-library/library/ai/context-dev/cmd/context-dev-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/ai/context-dev/cmd/context-dev-pp-mcp@latest), and the skill depends on that external content to run — so these repository install URLs present a runtime code-execution risk.