pp-ifood

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the required command-line tools using npx from the official npm registry (@mvanhorn/printing-press-library) and via go install from the author's public GitHub repository (github.com/mvanhorn/printing-press-library). These are well-known package managers and the source code belongs to the verified author.
  • [COMMAND_EXECUTION]: The skill's primary function is to execute the ifood-pp-cli binary to perform market research and cart planning. While it executes shell commands, it includes strong safety guidance: it explicitly forbids using the tool for checkout or payments and mandates that cart modifications (--execute) only occur after explicit human review of a dry-run preview.
  • [CREDENTIALS_SAFE]: The skill follows security best practices by utilizing a 'browser-backed' workflow. This ensures that authentication tokens and anti-fraud states remain within the user's signed-in browser rather than being exported to or stored by the agent skill itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 05:43 AM
Security Audit — agent-trust-hub — pp-ifood