pp-plane

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime install commands that fetch and install executable code from remote locations (e.g. curl https://github.com/mvanhorn/printing-press-library/releases/download/plane-current/plane-pp-cli-linux-amd64 and go install github.com/mvanhorn/printing-press-library/.../plane-pp-cli@latest and github.com/mvanhorn/printing-press-library/.../plane-pp-mcp@latest, plus the npx @mvanhorn/printing-press-library installer), which downloads remote binaries/source that will be executed and are required for the skill to run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs installing the CLI using privileged operations (e.g., "sudo mv" to /usr/local/bin and clearing Gatekeeper) which requests elevated privileges and modifies system files, so it pushes the agent to change machine state.