pp-cosmos

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the cosmos-pp-cli and cosmos-pp-mcp tools using npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/.... These resources are hosted within the vendor's official package namespace and repository structure.
  • [COMMAND_EXECUTION]: The agent is instructed to use the Read Bash tool to execute a wide variety of shell commands to interact with the Cosmos API, manage local configuration, and perform data operations.
  • [DYNAMIC_EXECUTION]: The skill utilizes a self-capturing learning loop where the cosmos-pp-cli recall command provides 'playbooks' and 'trial commands' that the agent is expected to execute. This involves dynamic command construction from tool-provided templates with slot substitutions.
  • [DATA_EXFILTRATION]: Supports a --deliver webhook:<url> flag, allowing the agent to POST command results, including exported collection data, to arbitrary external URLs.
  • [INDIRECT_PROMPT_INJECTION]: The skill's 'Automatic learning' and 'Discovery' features ingest data from the Cosmos GraphQL API, which is then used to generate future command suggestions and playbooks for the agent.
  • Ingestion points: cosmos-pp-cli recall, collection coverage, and element trail output.
  • Boundary markers: The CLI uses a structured JSON response envelope to separate tool metadata from data results.
  • Capability inventory: The agent has shell execution capabilities via the Read Bash tool.
  • Sanitization: The CLI documentation notes that it attempts to strip PII and uses structural mapping, though the agent remains responsible for validating trial commands before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 05:30 PM
Security Audit — agent-trust-hub — pp-cosmos