pp-doordash

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow is executing the doordash-pp-cli commands (e.g., search, menu, item-options, recent-orders) which fetch DoorDash data via the CLI’s GraphQL/HTTP transport; this ingests outsider-authored free text from DoorDash’s public web/app content into the agent’s LLM context via the CLI’s --agent JSON stdout.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime/setup explicitly instructs running remote installers that fetch and execute code (npx -y @mvanhorn/printing-press-library install doordash and go install github.com/mvanhorn/printing-press-library/library/commerce/doordash/cmd/doordash-pp-cli@latest), so required external content would be executed.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit DoorDash mutation commands that can create and submit orders and modify carts (e.g., graphql create-add-cart-item, create-update-cart-item-v2, create-remove-cart-item-v2, and crucially graphql create-create-order-from-cart — "Mutation: submit a DoorDash order from a cart"). It also includes payment-status polling (create-poll-order-payment-status) and requires session auth (cookies/CSRF). These are specific, order/payment-related APIs (not generic browser or HTTP tooling) and therefore grant the ability to execute financial transactions (place paid orders). Guarding language does not remove the fact these specific actions exist.