pp-sutra-fitness

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). This skill’s required workflow invokes a CLI that syncs/queries studio data from the Sutra/Arketa Partner API at runtime; that fetched data (e.g., class/client/purchase/referral records) is untrusted external text that can be passed into the agent’s LLM context via the CLI’s --agent JSON stdout output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes go install commands that fetch and build remote code at runtime from github.com/mvanhorn/printing-press-library/library/productivity/sutra-fitness/cmd/sutra-fitness-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/productivity/sutra-fitness/cmd/sutra-fitness-pp-mcp@latest, which executes remote code required for the skill to run.