pp-forgejo

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly includes mechanisms to send command output to arbitrary webhooks and auto-send feedback, and documents commands that can enumerate sensitive user data and tokens (admin/user/email/token commands and stored profiles), which together enable straightforward data exfiltration if misused or run by an automated agent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). This skill’s required workflow is to run forgejo-pp-cli ... --agent, which fetches Forgejo instance/API data (e.g., issues/PRs/comments/threads authored by other users) and returns it as JSON results; that JSON then becomes LLM-readable context for the agent, creating an indirect prompt-injection path from outsider-authored text in the Forgejo outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing remote binaries at runtime via go install github.com/mvanhorn/printing-press-library/library/developer-tools/forgejo/cmd/forgejo-pp-cli@latest and go install github.com/mvanhorn/printing-press-library/library/developer-tools/forgejo/cmd/forgejo-pp-mcp@latest, which fetch and execute remote code as a required prerequisite.