pp-ucp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is to run the ucp-pp-cli commands (e.g., check <domain> / search / cart / checkout prep) which fetch merchant-provided UCP manifests and other HTTP responses at runtime, so outsider-authored free text from public merchant domains can be ingested into the agent’s LLM context via the CLI’s JSON/stdout output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs installing and running remote code via "npx -y @mvanhorn/printing-press-library install ucp --cli-only" and "go install github.com/mvanhorn/printing-press-library/.../ucp-pp-cli@latest" (and the MCP server go install), which fetch and execute external code that the skill requires.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly built to interact with merchants' checkout flows: it can build carts, "prep a checkout draft", and exposes a checkout command (ucp-pp-cli checkout — POST /checkout). Those capabilities are specifically designed for e-commerce payment/checkout operations (i.e., moving money or initiating purchases), not generic browsing or tooling. Therefore it grants direct financial execution authority.