pp-fooda

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the fooda-pp-cli and fooda-pp-mcp tools via npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/....
  • [DATA_EXFILTRATION]: The CLI utility includes a --deliver webhook:<url> flag, which enables the redirection of command output (potentially containing order history, spend trends, or subsidy data) to an external HTTP endpoint.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent learning loop (recall, teach, playbook amend) that stores user-provided queries and observations to influence future agent behavior.
  • Ingestion points: User-provided queries are passed to recall and teach commands in SKILL.md.
  • Boundary markers: The instructions recommend using shell variables and file reads (QUERY=$(cat ...)) to avoid direct shell interpolation of user input.
  • Capability inventory: Subprocess execution of the fooda-pp-cli binary, local file system reads/writes for configuration and state storage, and network requests to Fooda and optional feedback/webhook endpoints.
  • Sanitization: While the skill warns against PII in taught queries, there is no technical enforcement or sanitization of instructions embedded within the query text before they are stored and later replayed as "playbooks".
  • [COMMAND_EXECUTION]: The skill relies on executing the fooda-pp-cli binary to perform its core functions, including interacting with browser session cookies to fetch user data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 04:35 PM