pp-coffee-goat
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core CLI and MCP server components from the author's GitHub and NPM namespaces.
- Evidence: Installation via
npx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/.... - Analysis: These are recognized as vendor resources associated with the author 'mvanhorn' as specified in the provided context.
- [COMMAND_EXECUTION]: The skill operates by executing the
coffee-goat-pp-clibinary to process user requests. - Evidence: Direct Use instructions and numerous command examples such as
coffee-goat god-cup --method espresso --agent. - Analysis: The agent is instructed to execute shell commands with user-provided arguments, utilizing an
--agentflag for structured output. - [DATA_EXFILTRATION]: The CLI includes a built-in feature to deliver command output directly to external webhooks.
- Evidence: The
--deliver webhook:<url>flag documentation inSKILL.md. - Analysis: This is a documented feature for data routing but provides a functional mechanism for sending processed data to arbitrary network endpoints.
Audit Metadata