pp-mobbin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is to run mobbin-pp-cli in --agent mode, which (per the doc) performs authenticated Mobbin searches and “per-app HTML scraping”/full content retrieval; those live results are then emitted as JSON on stdout and thus become LLM-readable context, and the scraped/returned text is outsider-authored (Mobbin’s public/proprietary content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructions include "go install github.com/mvanhorn/printing-press-library/library/productivity/mobbin/cmd/mobbin-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/productivity/mobbin/cmd/mobbin-pp-mcp@latest", which fetch and execute remote code as part of setup and are required for the CLI the skill depends on.