pp-hotelist

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow runs hotelist-pp-cli with --agent, which ingests Hotelist-scraped hotel/review/photo-verified data (outsider-authored web content) and returns it as JSON on stdout for the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite/install steps fetch and execute remote code via the Go module paths "go install github.com/mvanhorn/printing-press-library/library/travel/hotelist/cmd/hotelist-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/travel/hotelist/cmd/hotelist-pp-mcp@latest", which are runtime external dependencies that download and install code required for the skill.