pp-discord
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the discord-pp-cli tool from the vendor's repository (@mvanhorn/printing-press-library) using npx and go install.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the discord-pp-cli binary to manage Discord applications, guilds, and channels.
- [DATA_EXFILTRATION]: The CLI includes a delivery feature (--deliver webhook:) that enables the agent to transmit command results to arbitrary external web services.
- [PROMPT_INJECTION]: The skill implements a stateful 'learning loop' (recall, teach, playbook amend) that stores interaction recipes in a local SQLite database. This creates an Indirect Prompt Injection surface where data ingested from the Discord API could lead to the persistence of malicious instructions in future sessions.
- Ingestion points: Discord API responses and the local learning store retrieved via the recall command.
- Boundary markers: Absent; there are no explicit delimiters or warnings to isolate recalled playbooks from the core agent instructions.
- Capability inventory: The skill can interact with the Discord API, write local state files (data.db, teach.log), and perform network operations via the webhook delivery system.
- Sanitization: The instructions advise stripping PII from taught queries but do not provide technical measures to sanitize the logic stored within playbooks.
Audit Metadata