pp-pexels

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). This skill only reads first-party provider-authored content at runtime (it queries the Pexels API via the pexels-pp-cli binary using user-supplied search terms), and there is no workflow step that ingests outsider-authored free text from an untrusted feed/queue/inbox or arbitrary page content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime/install path fetches and executes remote code required for operation (e.g., "go install github.com/mvanhorn/printing-press-library/library/media-and-entertainment/pexels/cmd/pexels-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/media-and-entertainment/pexels/cmd/pexels-pp-mcp@latest"), so these external module URLs are used at runtime to obtain and run code the skill depends on.