pp-kdpnichefinder
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
kdpnichefinder-pp-cliandkdpnichefinder-pp-mcpbinaries from the author's official GitHub repository (github.com/mvanhorn/printing-press-library) and the official NPM registry via the@mvanhorn/printing-press-librarypackage. - [DATA_EXFILTRATION]: The skill includes functionality for external data transmission:
- The
--deliver webhook:<url>argument allows the agent to send command outputs, which may contain niche research results, to any user-specified external URL. - The
feedbackcommand can be configured to automatically send local usage notes to a remote server using theKDPNICHEFINDER_FEEDBACK_AUTO_SENDenvironment variable. - [COMMAND_EXECUTION]: The skill requires the
Bashtool to perform software installation and to execute the core research CLI tool. - [PROMPT_INJECTION]: There is an indirect prompt injection surface through the processing of untrusted external content:
- Ingestion points: Data is brought into the agent context via the
niches,rank, andkeywordscommands which retrieve book titles and metadata from Amazon KDP buckets. - Boundary markers: None. The skill does not implement specific delimiters or 'ignore' instructions for data processed from the KDP source.
- Capability inventory: The agent is equipped with the
Bashtool, enabling shell command execution based on processed data. - Sanitization: No specific sanitization or filtering of the ingested book titles or metadata is described before output.
Audit Metadata