pp-cosmos
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
cosmos-pp-cliandcosmos-pp-mcptools usingnpx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/.... These resources are hosted within the vendor's official package namespace and repository structure. - [COMMAND_EXECUTION]: The agent is instructed to use the
Read Bashtool to execute a wide variety of shell commands to interact with the Cosmos API, manage local configuration, and perform data operations. - [DYNAMIC_EXECUTION]: The skill utilizes a self-capturing learning loop where the
cosmos-pp-cli recallcommand provides 'playbooks' and 'trial commands' that the agent is expected to execute. This involves dynamic command construction from tool-provided templates with slot substitutions. - [DATA_EXFILTRATION]: Supports a
--deliver webhook:<url>flag, allowing the agent to POST command results, including exported collection data, to arbitrary external URLs. - [INDIRECT_PROMPT_INJECTION]: The skill's 'Automatic learning' and 'Discovery' features ingest data from the Cosmos GraphQL API, which is then used to generate future command suggestions and playbooks for the agent.
- Ingestion points:
cosmos-pp-cli recall,collection coverage, andelement trailoutput. - Boundary markers: The CLI uses a structured JSON response envelope to separate tool metadata from data results.
- Capability inventory: The agent has shell execution capabilities via the
Read Bashtool. - Sanitization: The CLI documentation notes that it attempts to strip PII and uses structural mapping, though the agent remains responsible for validating trial commands before execution.
Audit Metadata