pp-clockify
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
clockify-pp-cliutility vianpx(targeting@mvanhorn/printing-press-library) orgo install(targeting the vendor's GitHub repository). These sources belong to the identified vendor infrastructure. - [COMMAND_EXECUTION]: The skill provides a mechanism for the agent to execute subcommands and arguments via the
clockify-pp-clibinary based on user-supplied input. It also utilizes theRead Bashtool to perform installation and system verification checks. - [DATA_EXFILTRATION]: The CLI tool includes a
--deliver webhook:<url>feature that allows output to be POSTed to arbitrary external URLs, enabling automated data workflows. Additionally, a feedback mechanism is provided that can send local logs to a remote endpoint if theCLOCKIFY_FEEDBACK_ENDPOINTenvironment variable is explicitly configured. - [CREDENTIALS_UNSAFE]: The skill manages the
CLOCKIFY_API_KEYfor authentication. It follows secure practices by instructing users to store the key in an environment variable rather than hardcoding it within scripts or instructions. - [DATA_EXFILTRATION]: The
backfillcommand allows the agent to read local files (e.g.,session.jsonl) to reconstruct time entries, which is an intended data-importing feature of the productivity tool.
Audit Metadata