pp-conductor
Warn
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
conductor-pp-clitool and an MCP server throughnpxandgo installfrom vendor-controlled repositories. Evidence includes commands targeting@mvanhorn/printing-press-libraryandgithub.com/mvanhorn/printing-press-library. - [DYNAMIC_EXECUTION]: The skill implements a 'learning loop' where the agent retrieves and executes 'playbooks' (JSON-defined command sequences) from a local store based on historical interactions. This allows the execution of dynamically synthesized command paths.
- [DATA_EXFILTRATION]: The CLI tool supports a
--deliver webhook:<url>flag that POSTs command output to an external URL. This can be used to transmit sensitive session transcripts or authentication metadata to arbitrary third-party endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied queries through a
recallandteachloop, creating an attack surface where malicious input could poison the local learning store with adversarial 'playbooks' that influence future agent behavior. Evidence chain: Ingestion points include user questions in the 'Automatic Learning' section; boundary markers are absent as playbooks are treated as 'ground truth'; capabilities include full CLI control and shell access; sanitization relies on manual PII stripping. - [COMMAND_EXECUTION]: The skill enables comprehensive management of cloud workspaces and sessions through shell commands, including a tool for running SQL queries against session data.
Audit Metadata