pp-postman-explore

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill directly queries and ingests community-contributed public content from the Postman Explore network (postman.com/explore) via commands like browse, search-all, and networkentity list-network-entities, and the agent-mode JSON outputs are intended to be read/used by agents to make decisions (e.g., canonical, top, similar), so untrusted third‑party content can materially influence tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running external code at runtime via npx -y @mvanhorn/printing-press (npm package) and go install github.com/mvanhorn/printing-press-library/library/developer-tools/postman-explore/cmd/postman-explore-pp-cli@latest, which fetch and execute remote code and are required for the skill to run.