pp-conductor

Warn

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the conductor-pp-cli tool and an MCP server through npx and go install from vendor-controlled repositories. Evidence includes commands targeting @mvanhorn/printing-press-library and github.com/mvanhorn/printing-press-library.
  • [DYNAMIC_EXECUTION]: The skill implements a 'learning loop' where the agent retrieves and executes 'playbooks' (JSON-defined command sequences) from a local store based on historical interactions. This allows the execution of dynamically synthesized command paths.
  • [DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag that POSTs command output to an external URL. This can be used to transmit sensitive session transcripts or authentication metadata to arbitrary third-party endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied queries through a recall and teach loop, creating an attack surface where malicious input could poison the local learning store with adversarial 'playbooks' that influence future agent behavior. Evidence chain: Ingestion points include user questions in the 'Automatic Learning' section; boundary markers are absent as playbooks are treated as 'ground truth'; capabilities include full CLI control and shell access; sanitization relies on manual PII stripping.
  • [COMMAND_EXECUTION]: The skill enables comprehensive management of cloud workspaces and sessions through shell commands, including a tool for running SQL queries against session data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 27, 2026, 03:09 AM