pp-claude-agent-sdk-python-docs
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a CLI binary and an MCP server using
go installfromgithub.com/mvanhorn/printing-press-libraryandnpxfrom the@mvanhorn/printing-press-librarypackage on NPM. - [COMMAND_EXECUTION]: The skill executes the
claude-agent-sdk-python-docs-pp-clibinary to perform its core functions, including documentation lookups and code verification. - [DATA_EXFILTRATION]: The CLI tool includes a
--deliver webhook:<url>flag, allowing command output (which can include snippets of local source code processed via theverifycommand) to be sent to arbitrary external URLs via POST requests. - [PROMPT_INJECTION]: The skill processes untrusted data from local source code and remote documentation corpora. It lacks explicit boundary markers or instructions to ignore embedded malicious prompts within these sources, which constitutes an indirect prompt injection surface.
Audit Metadata