pp-framer
Warn
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the
framer-pp-clitool from external sources, specifically usingnpx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/library/developer-tools/framer/cmd/framer-pp-cli@latest. - [DATA_EXFILTRATION]: The CLI supports an output delivery mechanism via the
--deliver webhook:<url>flag, which enables the transmission of command results—including CMS content, project source code, and site metadata—to any external HTTP endpoint. - [DATA_EXFILTRATION]: The skill includes a
feedbacksystem that aggregates local notes and can automatically transmit them to a remote server if theFRAMER_FEEDBACK_ENDPOINTenvironment variable is configured. - [COMMAND_EXECUTION]: The skill operates by executing shell commands via the
framer-pp-clibinary, which manages local project state, interacts with the filesystem, and orchestrates network requests. - [CREDENTIALS_UNSAFE]: The skill requires the management of
FRAMER_API_KEY, a high-privilege credential used to authenticate against the Framer Server API. It provides instructions for exporting this key into the environment.
Audit Metadata