pp-copper

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the copper-pp-cli binary using npx -y @mvanhorn/printing-press-library install copper or go install github.com/mvanhorn/printing-press-library/.... These resources are hosted on NPM and GitHub under the author's account.
  • [DATA_EXFILTRATION]: The skill features a --deliver webhook:<url> flag and a feedback command that can transmit command output or feedback to remote endpoints. These are documented capabilities for data routing and user feedback.
  • [COMMAND_EXECUTION]: The primary function of the skill is to invoke the copper-pp-cli utility through the agent's shell capability to interact with the Copper CRM API and local database.
  • [PROMPT_INJECTION]: As the skill ingests and processes records from an external CRM (Copper), it is subject to indirect prompt injection if those records contain adversarial instructions designed to influence the agent's behavior.
  • Ingestion points: copper-pp-cli search, get, and activity commands (SKILL.md)
  • Boundary markers: None specified in instructions
  • Capability inventory: copper-pp-cli (subprocess calls), npx, go install
  • Sanitization: Not mentioned in instructions
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 09:51 PM
Security Audit — agent-trust-hub — pp-copper