pp-doordash

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow exposes DoorDash “read-only” commands that accept outsider-supplied free-text search queries (e.g., search → create-autocomplete-facet-feed) and may ingest that query without selecting a specific pre-existing item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs installing a required CLI by running "go install github.com/mvanhorn/printing-press-library/library/commerce/doordash/cmd/doordash-pp-cli@latest", which will fetch and execute remote code from that GitHub path at install/runtime, so this external dependency can directly execute code on the agent host.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes DoorDash GraphQL mutations that can submit live orders and modify carts (not just read-only). Specifically, it documents "create-create-order-from-cart — Mutation: submit a DoorDash order from a cart" plus add/remove/update-cart-item mutations and a payment-status poll. Those are explicit transaction-executing operations that can result in charges to a user's payment method (even if some commands are gated), so the skill grants direct financial execution capability.