pp-rappi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes running rappi-pp-cli commands that fetch restaurant/store detail pages and other catalog data (e.g., “SSR list and detail pages”); if those fetched pages’ text is injected into the agent via the CLI’s stdout/JSON response for LLM consumption, it can include outsider-authored free text (from Rappi’s website/API) through the runtime path of CLI output → agent LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite install commands fetch and execute remote code at install time (e.g., "npx -y @mvanhorn/printing-press-library install rappi --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/food-and-dining/rappi/cmd/rappi-pp-cli@latest"), and the CLI is required before the skill can run, so these remote fetches present a runtime-executed dependency risk.