pp-copper
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
copper-pp-clibinary usingnpx -y @mvanhorn/printing-press-library install copperorgo install github.com/mvanhorn/printing-press-library/.... These resources are hosted on NPM and GitHub under the author's account. - [DATA_EXFILTRATION]: The skill features a
--deliver webhook:<url>flag and afeedbackcommand that can transmit command output or feedback to remote endpoints. These are documented capabilities for data routing and user feedback. - [COMMAND_EXECUTION]: The primary function of the skill is to invoke the
copper-pp-cliutility through the agent's shell capability to interact with the Copper CRM API and local database. - [PROMPT_INJECTION]: As the skill ingests and processes records from an external CRM (Copper), it is subject to indirect prompt injection if those records contain adversarial instructions designed to influence the agent's behavior.
- Ingestion points:
copper-pp-clisearch, get, and activity commands (SKILL.md) - Boundary markers: None specified in instructions
- Capability inventory:
copper-pp-cli(subprocess calls),npx,go install - Sanitization: Not mentioned in instructions
Audit Metadata