pp-judge-me

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime path is the CLI querying Judge.me APIs and returning (potentially unsanitized) review/widget text (outsider-authored “raw review information” and other store/app content) that the agent consumes in its outputs/context when using --agent (per the doc’s warning that endpoints may include unsanitized review content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the runtime to fetch and execute remote Go modules using "go install github.com/mvanhorn/printing-press-library/library/marketing/judge-me/cmd/judge-me-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/marketing/judge-me/cmd/judge-me-pp-mcp@latest", which downloads and runs remote code and are required prerequisites for the skill.