pp-gorgias

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill is a CLI wrapper that, in “agent mode” (--agent), ingests and returns Gorgias API/local SQLite ticket/message/customer text (e.g., via tickets messages-list/get, ticket-search, sync/search), which is outsider-authored content from the Gorgias tenant’s support conversations rather than user-authored prompts/files.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing the gorgias-pp-cli by fetching and running remote code (via "npx -y @mvanhorn/printing-press-library install gorgias --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/sales-and-crm/gorgias/cmd/gorgias-pp-cli@latest"), so external content from the npm package / GitHub repo would be fetched and executed as a required dependency.