pp-pipedrive

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). This skill’s required runtime workflow runs the pipedrive-pp-cli with --agent, which outputs live data/results (including any Pipedrive-stored note/message/text fields) into stdout for the agent to ingest into the LLM context—i.e., outsider-authored free text originating from the customer’s Pipedrive account rather than the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's prerequisites include commands that fetch and install remote code which would be executed to provide the required CLI (e.g., "npx -y @mvanhorn/printing-press-library install pipedrive --cli-only" and the two go install github.com/mvanhorn/printing-press-library/...@latest lines), so the skill relies on running fetched remote code to function.