pp-aol-puglia
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the CLI using
npxfrom the@mvanhornorganization on npm or viago installfrom a GitHub repository owned by the same author/vendor. As 'mvanhorn' is the listed vendor context and these are standard package distribution methods, this represents intended functionality. - [COMMAND_EXECUTION]: The skill facilitates the execution of its own CLI binary (
aol-puglia-pp-cli) to interact with legal and administrative documents from the Puglia region's official health portal. Commands include searching acts (atti search), downloading attachments as base64, and managing local configuration profiles. - [CREDENTIALS_UNSAFE]: The skill documentation includes an example of setting an authentication token via
aol-puglia-pp-cli auth set-token YOUR_TOKEN_HERE. However, it also explicitly suggests setting the token as an environment variable (AOL_PUGLIA_BEARER_AUTH), which follows security best practices for secret management. Access is controlled via standard OAuth2 client credentials. - [DATA_EXFILTRATION]: While the skill includes a
--deliver webhook:<url>feature, this is a standard capability of the 'Printing Press' CLI family for routing results. It requires explicit user/agent opt-in per command and is not used for silent exfiltration of sensitive local data.
Audit Metadata