pp-postman-explore

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This CLI explicitly fetches and ingests community-contributed, public content from the Postman Explore directory (postman.com/explore) — e.g., commands like canonical, browse, search-all, and networkentity list-network-entities return JSON results intended for agent consumption (see "Agent Mode" and the command examples), so untrusted third‑party content can influence agent decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill instructs installing and running externally fetched binaries at runtime (via "npx -y @mvanhorn/printing-press install postman-explore --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/developer-tools/postman-explore/cmd/postman-explore-pp-cli@latest"), which downloads and executes remote code that the skill requires to function.