pp-ikon

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of binary tools (ikon-pp-cli and ikon-pp-mcp) from vendor-managed sources. It provides commands for npx to download the @mvanhorn/printing-press-library package and go install for modules hosted under github.com/mvanhorn/printing-press-library.
  • [COMMAND_EXECUTION]: The skill uses shell commands to manage the tool lifecycle, including installation, verification of the environment via which, and executing the CLI with the --agent flag for non-interactive data retrieval.
  • [DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature that allows the user to POST command results, which may include sensitive personal account data and reservation details, to an external HTTP endpoint.
  • [DATA_EXFILTRATION]: The feedback command can be configured to transmit local diagnostic or usage data to a remote server if the IKON_FEEDBACK_ENDPOINT environment variable is defined.
  • [DATA_EXFILTRATION]: The tool's authentication mechanism (auth login --chrome) retrieves session cookies from the local Chrome browser instance to enable communication with Ikon Pass account services.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 10:59 PM
Security Audit — agent-trust-hub — pp-ikon