pp-ebay

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the download and installation of binary tools and packages from the author's GitHub repository and NPM. These are recognized as vendor-owned resources.
  • [COMMAND_EXECUTION]: The skill operates by executing the ebay-pp-cli binary with various user-supplied or agent-generated arguments to interact with eBay services.
  • [DATA_EXFILTRATION]: The CLI tool includes a --deliver webhook:<url> feature that allows the agent to POST the results of any command to an arbitrary external URL. It also features a feedback mechanism that can be configured to send local logs to a remote endpoint via environment variables.
  • [CREDENTIALS_UNSAFE]: To enable authenticated features like watchlists, the skill directs users to utilize cookie extraction utilities (such as pycookiecheat or cookies) to import browser session data into the CLI.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external eBay listings, such as titles and item descriptions, which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Results from active auctions, sold listings, and item details fetched from eBay.
  • Boundary markers: None specified; instructions do not include markers to isolate or ignore instructions embedded in the external data.
  • Capability inventory: The skill can perform network operations (webhooks, feedback), write to local files, and execute shell commands.
  • Sanitization: No sanitization or validation of the retrieved eBay data is defined before the agent processes it.
  • [DYNAMIC_EXECUTION]: The installation process involves go install and npx, which download and prepare executable code on the host system at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 09:07 AM