pp-parallel

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to "replay Playbook.steps" by substituting Playbook.slots_resolved entries (which include a "token" field) into command slots, effectively forcing the LLM to insert live token/API values verbatim into generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow can ingest outsider-authored free text via user-provided natural-language queries passed to agent mode (e.g., parallel-pp-cli recall "<user's question>" --agent) and those queries drive tool calls that fetch and extract content from web URLs (e.g., extract, tasks, findall, monitors).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's documented fallback install commands use go install on github.com/mvanhorn/printing-press-library/.../parallel-pp-cli@latest and .../parallel-pp-mcp@latest (lines 23 and 541), which fetch remote Go code and build/execute binaries the skill requires at runtime, so these are runtime external dependencies that can execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes a service command that charges the organization's default payment method: "service account-add-balance — Charge the organization's default payment method and add the amount to the prepaid credit balance." This is an explicit payment/charge capability (direct financial execution). The doc also warns about using the account-balance add for unattended spends and describes account endpoints requiring OAuth, reinforcing that this CLI can perform authorized payment operations.