Skills
Navigate
skills/mvanhorn/printing-press-library/pp-cal-com/Gen Agent Trust Hub

pp-cal-com

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the cal-com-pp-cli tool and MCP server using npx from the @mvanhorn registry and go install from the vendor's GitHub repository (github.com/mvanhorn/printing-press-library). These are standard installation methods for the tool.
  • [COMMAND_EXECUTION]: The primary purpose of this skill is to execute shell commands via the cal-com-pp-cli binary to interact with the Cal.com API and local state.
  • [DATA_EXFILTRATION]: The tool includes a --deliver webhook:<url> flag and a feedback mechanism that can POST data to remote endpoints. While these are documented features for automation and support, they provide potential vectors for data transfer to external services.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources such as booking details and calendar agendas.
  • Ingestion points: SKILL.md (via commands like agenda, bookings get, and slots find).
  • Boundary markers: Not present in the provided instructions.
  • Capability inventory: Full subprocess execution for the cal-com-pp-cli tool via the Bash tool.
  • Sanitization: No specific sanitization or escaping of external content is mentioned before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 02:16 PM