pp-loopnet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent/user to paste a browser "Cookie" header into a CLI flag (loopnet-pp-cli auth set --cookies ""), which requires embedding secret cookie values verbatim into generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The LoopNet Printing Press CLI ingests outsider-authored free text at runtime via user-provided natural-language queries/options (e.g., loopnet-pp-cli which "<capability in your own words>" and general CLI arguments that are passed through to browsing/search endpoints), so the agent can process arbitrary text before selecting a specific fixed item.