pp-ashby
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the necessary CLI binary via remote sources.
- Evidence includes
npx -y @mvanhorn/printing-press-library install ashby --cli-onlyandgo install github.com/mvanhorn/printing-press-library/library/job-boards/ashby/cmd/ashby-pp-cli@latest. - [DATA_EXFILTRATION]: The command suite includes a
--deliverflag that supports awebhook:<url>sink. - This allows the output of any command (such as job lists or search results) to be POSTed to an arbitrary external URL, creating a surface for data redirection.
- [COMMAND_EXECUTION]: The skill extensively uses a local binary
ashby-pp-cliand instructs the agent to use shell backgrounding (&) for certain operations. - Specifically, the
teachandplaybook amendcommands are intended to be run in the background to avoid blocking the agent's response flow. - [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Learning Loop' (
recall,teach,playbook,amend) which processes and stores user-influenced queries and choreography. - Ingestion points: User questions and trial commands are ingested via
recallandteach(SKILL.md). - Boundary markers: The skill instructs the agent to strip PII before teaching, but there are no technical enforcement markers in the command strings.
- Capability inventory: The skill has capabilities for network operations (API fetch, webhooks) and local file writes (sync to SQLite, learning logs, profiles).
- Sanitization: There is no explicit sanitization described for the stored 'playbooks' or 'notes' beyond a manual instruction to the agent.
- [PERSISTENCE]: The skill manages persistent state through several mechanisms.
- It stores local SQLite databases (
sync), command profiles (profile save), learning event logs, and 'teach' journals, which persist across different agent sessions.
Audit Metadata