pp-loopnet

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the operator to paste a browser Cookie header into a command argument (loopnet-pp-cli auth set --cookies ""), which requires handling and embedding secret cookie values verbatim in commands—an insecure credential-exfiltration pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow is to run loopnet-pp-cli in --agent mode, which fetches LoopNet listing pages and returns their JSON/fields (including listing description/free text) into the agent’s LLM context via the CLI’s stdout/JSON output; this is outsider-authored web content (public web pages) at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites require fetching and executing remote installer code (npx -y @mvanhorn/printing-press-library install loopnet --cli-only and go install github.com/mvanhorn/printing-press-library/library/commerce/loopnet/cmd/loopnet-pp-cli@latest), which are runtime external dependencies that execute remote code to provide the required loopnet-pp-cli binary.