pp-exa

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes an explicit CLI example that passes a token on the command line (exa-pp-cli auth set-token YOUR_TOKEN_HERE) and instructs replaying playbook steps with slots_resolved substitutions that can contain a "token" value, which requires embedding secret values verbatim into generated commands — an immediate secret-exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime path relies on Exa searches/contents/monitors/websets (e.g., exa-pp-cli websearch and exa-pp-cli monitors ... fetching and extracting web page content), which can include outsider-authored free text when the user supplies or selects queries/items that cause the CLI to retrieve those pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite/install steps call "go install github.com/mvanhorn/printing-press-library/library/ai/exa/cmd/exa-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/ai/exa/cmd/exa-pp-mcp@latest", which fetch and execute remote code during setup and are required before the skill can run.