pp-github-contents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the pp-github-contents runtime workflow, the agent’s free-text “user question” is used to drive github-contents-pp-cli recall "<user's question>" --agent and then to select which GitHub repo path/ref to fetch, so outsider-authored text can influence what content is read from GitHub (via subsequent contents/fetch/trees calls).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime requires installing and running Go packages fetched from GitHub (e.g., github.com/mvanhorn/printing-press-library/library/developer-tools/github-contents/cmd/github-contents-pp-cli@latest via go install), which pulls remote code that is compiled/executed on the host.