pp-erank

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill is to execute erank-pp-cli ... --agent, which calls eRank member endpoints (e.g., /api/keyword-tool/top-listings, /api/keyword-tool/related-searches) and ingests the returned listing/search text into the agent’s JSON/LLM context; those responses are outsider-authored content from a third-party service, not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime installation of remote packages that fetch and execute code (e.g., go install github.com/mvanhorn/printing-press-library/library/marketing/erank/cmd/erank-pp-cli@latest and go install github.com/mvanhorn/printing-press-library/library/marketing/erank/cmd/erank-pp-mcp@latest, and an npx install of @mvanhorn/printing-press-library), so it relies on executing externally fetched code at runtime.