pp-human-goat
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing a local binary named
human-goat-pp-cli. This tool is used for all primary functions, including hiring labor, checking task status, and managing account configuration. - [EXTERNAL_DOWNLOADS]: To function, the skill requires the installation of external components from the author's public repositories. This includes a Go module (
github.com/mvanhorn/printing-press-library) and an npm package (@mvanhorn/printing-press-library). - [PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically tasker biographies, reviews, and errand statuses from the TaskRabbit and Magic networks. This creates a surface for indirect prompt injection if these external data points contain malicious instructions aimed at the agent's execution logic.
Audit Metadata