pp-ashby

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the necessary CLI binary via remote sources.
  • Evidence includes npx -y @mvanhorn/printing-press-library install ashby --cli-only and go install github.com/mvanhorn/printing-press-library/library/job-boards/ashby/cmd/ashby-pp-cli@latest.
  • [DATA_EXFILTRATION]: The command suite includes a --deliver flag that supports a webhook:<url> sink.
  • This allows the output of any command (such as job lists or search results) to be POSTed to an arbitrary external URL, creating a surface for data redirection.
  • [COMMAND_EXECUTION]: The skill extensively uses a local binary ashby-pp-cli and instructs the agent to use shell backgrounding (&) for certain operations.
  • Specifically, the teach and playbook amend commands are intended to be run in the background to avoid blocking the agent's response flow.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Learning Loop' (recall, teach, playbook, amend) which processes and stores user-influenced queries and choreography.
  • Ingestion points: User questions and trial commands are ingested via recall and teach (SKILL.md).
  • Boundary markers: The skill instructs the agent to strip PII before teaching, but there are no technical enforcement markers in the command strings.
  • Capability inventory: The skill has capabilities for network operations (API fetch, webhooks) and local file writes (sync to SQLite, learning logs, profiles).
  • Sanitization: There is no explicit sanitization described for the stored 'playbooks' or 'notes' beyond a manual instruction to the agent.
  • [PERSISTENCE]: The skill manages persistent state through several mechanisms.
  • It stores local SQLite databases (sync), command profiles (profile save), learning event logs, and 'teach' journals, which persist across different agent sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:56 PM