pp-podcast-goat

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches podcast episode transcripts and web content from user-provided URLs and third-party podcast platforms (YouTube, Substack, RSS feeds, spoken.md), which is classified as low risk since the agent actively fetches specific URLs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installation of a remote Go package from github.com/mvanhorn/printing-press-library/library/media-and-entertainment/podcast-goat/cmd/podcast-goat-pp-cli@latest, which is an unofficial third-party repository providing executable runtime code.