pp-clockify

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the clockify-pp-cli utility via npx (targeting @mvanhorn/printing-press-library) or go install (targeting the vendor's GitHub repository). These sources belong to the identified vendor infrastructure.
  • [COMMAND_EXECUTION]: The skill provides a mechanism for the agent to execute subcommands and arguments via the clockify-pp-cli binary based on user-supplied input. It also utilizes the Read Bash tool to perform installation and system verification checks.
  • [DATA_EXFILTRATION]: The CLI tool includes a --deliver webhook:<url> feature that allows output to be POSTed to arbitrary external URLs, enabling automated data workflows. Additionally, a feedback mechanism is provided that can send local logs to a remote endpoint if the CLOCKIFY_FEEDBACK_ENDPOINT environment variable is explicitly configured.
  • [CREDENTIALS_UNSAFE]: The skill manages the CLOCKIFY_API_KEY for authentication. It follows secure practices by instructing users to store the key in an environment variable rather than hardcoding it within scripts or instructions.
  • [DATA_EXFILTRATION]: The backfill command allows the agent to read local files (e.g., session.jsonl) to reconstruct time entries, which is an intended data-importing feature of the productivity tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 09:18 AM
Security Audit — agent-trust-hub — pp-clockify