pp-cookunity
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing the cookunity-pp-cli binary using 'npx -y @mvanhorn/printing-press-library' and 'go install github.com/mvanhorn/printing-press-library/...'. These sources belong to the skill's author vendor context.
- [COMMAND_EXECUTION]: The skill implements a 'learning loop' (teach, recall, playbook) that auto-synthesizes 'playbooks' (JSON-defined command sequences) from the agent's session history. These playbooks are subsequently executed to automate tasks.
- [DATA_EXFILTRATION]: The skill provides a '--deliver webhook:' flag for all commands, allowing result data to be sent to arbitrary external URLs. It also includes a feedback command for sending data to a configured endpoint (COOKUNITY_FEEDBACK_ENDPOINT).
- [CREDENTIALS_UNSAFE]: Users are instructed to manually extract an Auth0 bearer token from their browser's developer tools and provide it to the CLI via the COOKUNITY_TOKEN environment variable.
- [PROMPT_INJECTION]: The skill mirrors external menu data and processes user-supplied learning queries, creating a surface for indirect prompt injection.
- Ingestion points: CookUnity menu API and user queries stored via teach.
- Boundary markers: Absent.
- Capability inventory: File system access (SQLite) and shell command execution via the CLI.
- Sanitization: Not explicitly implemented for external data processing.
Audit Metadata