Skills
skills/akillness/jeo-skills/ccpi-marketplace/Gen Agent Trust Hub

ccpi-marketplace

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the ccpi CLI tool from the NPM registry via @intentsolutionsio/ccpi using pnpm.
  • [EXTERNAL_DOWNLOADS]: Downloads and adds plugin packs from the jeremylongshore/claude-code-plugins-plus-skills repository on GitHub.
  • [COMMAND_EXECUTION]: Uses the Bash tool to execute ccpi marketplace commands, including search, install, list, and update operations.
  • [PROMPT_INJECTION]: The skill provides an interface to a marketplace (tonsofskills.com) which introduces a surface for indirect prompt injection via third-party plugin content.
  • Ingestion points: Marketplace search results and plugin metadata from GitHub.
  • Boundary markers: None explicitly defined for external content processing.
  • Capability inventory: Bash, WebFetch, Read, Write.
  • Sanitization: Relies on the underlying agent platform's plugin validation and the ccpi tool's handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 04:58 AM
Security Audit — agent-trust-hub — ccpi-marketplace