pp-nhc

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow invokes nhc-pp-cli commands like brief, advisory, storm, and outlook, which fetch and parse NHC/NWS content (e.g., “clean body text” from Public Advisories/Forecast Discussions) into LLM-readable prose, making it outsider-authored free text from external agencies.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's required install step runs remote code via "npx -y @mvanhorn/printing-press-library install nhc --cli-only", which fetches and executes a package from the network to install the required CLI, so it is a runtime external dependency that executes remote code.