pp-instacart

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The Backfill Flow in SKILL.md explicitly instructs the agent to WebFetch three JS files from raw.githubusercontent.com and to open/scrape pages on https://www.instacart.com/store/account/orders (injecting and reading extracted order pages), which are public, third‑party resources the agent fetches and interprets as part of its workflow and whose content can alter subsequent tool actions (history import and add resolution).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill's Backfill Flow explicitly WebFetches and injects remote JavaScript from raw.githubusercontent.com (e.g. https://raw.githubusercontent.com/mvanhorn/printing-press-library/main/library/commerce/instacart/docs/dumper.js, https://raw.githubusercontent.com/mvanhorn/printing-press-library/main/library/commerce/instacart/docs/extract-one.js, https://raw.githubusercontent.com/mvanhorn/printing-press-library/main/library/commerce/instacart/docs/export-jsonl.js) at runtime and executes that code in the user's browser, satisfying the criteria for a runtime external dependency that executes remote code.