pp-loopnet

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the loopnet-pp-cli tool via npx from the NPM registry (@mvanhorn/printing-press-library) or go install from GitHub (github.com/mvanhorn/printing-press-library). These are vendor-controlled resources.\n- [REMOTE_CODE_EXECUTION]: The installation methods npx and go install fetch and execute code from remote repositories to set up the environment.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to perform commercial real estate market analysis, manage local SQLite data stores, and generate intelligence reports.\n- [DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature that allows the output of any command—which may include detailed property records or market-intelligence summaries—to be automatically POSTed to an arbitrary external URL.\n- [PROMPT_INJECTION]: The skill ingests data from external LoopNet listing pages, creating a vulnerability surface for indirect prompt injection.\n
  • Ingestion points: External listing data is fetched through the inventory, property, and sync commands (SKILL.md).\n
  • Boundary markers: None. There are no explicit instructions for the agent to ignore or delimit natural language content found within property descriptions.\n
  • Capability inventory: The skill has access to the bash tool, writes to the file system (--out), and can send data over the network (--deliver webhook).\n
  • Sanitization: No specific sanitization or filtering of the listing text is documented before the content enters the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 07:21 AM