pp-apple-docs
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
apple-docs-pp-clibinary usingnpx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/library/developer-tools/apple-docs/cmd/apple-docs-pp-cli@latest. These commands download and execute third-party code from NPM and GitHub repositories.- [COMMAND_EXECUTION]: The agent is instructed to execute shell commands using theapple-docs-pp-clitool. The execution path involves passing user-supplied arguments directly to the CLI, which may pose a risk if the agent does not properly validate or sanitize the input before shell execution.- [DATA_EXFILTRATION]: Theapple-docs-pp-clitool features a--deliver webhook:<url>flag, allowing users or agents to route command output to arbitrary external URLs. It also includes a feedback mechanism that can be configured to POST data to a remote endpoint via theAPPLE_DOCS_FEEDBACK_ENDPOINTenvironment variable. While these are presented as features, they provide a mechanism for data exfiltration if directed to an untrusted server.
Audit Metadata