pp-fooda
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
fooda-pp-cliandfooda-pp-mcptools vianpx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/.... - [DATA_EXFILTRATION]: The CLI utility includes a
--deliver webhook:<url>flag, which enables the redirection of command output (potentially containing order history, spend trends, or subsidy data) to an external HTTP endpoint. - [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent learning loop (
recall,teach,playbook amend) that stores user-provided queries and observations to influence future agent behavior. - Ingestion points: User-provided queries are passed to
recallandteachcommands in SKILL.md. - Boundary markers: The instructions recommend using shell variables and file reads (
QUERY=$(cat ...)) to avoid direct shell interpolation of user input. - Capability inventory: Subprocess execution of the
fooda-pp-clibinary, local file system reads/writes for configuration and state storage, and network requests to Fooda and optional feedback/webhook endpoints. - Sanitization: While the skill warns against PII in taught queries, there is no technical enforcement or sanitization of instructions embedded within the query text before they are stored and later replayed as "playbooks".
- [COMMAND_EXECUTION]: The skill relies on executing the
fooda-pp-clibinary to perform its core functions, including interacting with browser session cookies to fetch user data.
Audit Metadata