pp-multimail

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill shows explicit commands that pass tokens directly (multimail-pp-cli auth set-token YOUR_TOKEN_HERE) and describes CLI responses that reveal raw API keys/signing secrets, which would require the agent to handle or emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly ingests inbound emails (described as "Inbound email converted to markdown" and exposed via commands like multimail-pp-cli emails, approve get, and confirm get/redirects to multimail.dev/confirm), which are untrusted user-generated content the agent is expected to read and that can influence approvals or outbound actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs installing and running remote code as a required dependency via npx (@mvanhorn/printing-press) and a Go install from github.com (go install github.com/mvanhorn/printing-press-library/library/social-and-messaging/multimail/cmd/multimail-pp-cli@latest), which fetches and executes remote code at install/runtime and therefore can directly control the agent's behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The CLI explicitly exposes payment gateway and crypto checkout operations. The billing commands include creating Stripe checkout sessions, returning Stripe-hosted billing portal URLs, creating Stripe webhook handlers, and creating Coinbase Commerce (crypto) checkouts. It also can update subscription billing state (set cancel_at_period_end). These are specific, primary-financial actions (create payment sessions, manage subscriptions, handle crypto checkouts), so this skill grants direct financial execution capability.