pp-loopnet
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
loopnet-pp-clitool from the author's official npm package (@mvanhorn/printing-press-library) and GitHub repository. - [COMMAND_EXECUTION]: The skill relies on executing the
loopnet-pp-clibinary to search LoopNet inventory, fetch property details, and perform market analysis. - [DATA_EXFILTRATION]: The underlying CLI tool includes a
--deliver webhook:<url>feature that allows routing command output (LoopNet property data) to external webhooks, which is a functional capability for data pipeline integration. - [PROMPT_INJECTION]: Indirect prompt injection surface identified.
- Ingestion points: The skill fetches untrusted data from LoopNet listing descriptions and search results via the
inventoryandpropertycommands (SKILL.md). - Boundary markers: Absent. The instructions do not explicitly require the agent to use delimiters or ignore embedded instructions within the property data.
- Capability inventory: The skill possesses the ability to write to files (
--deliver file:) and perform network POST requests (--deliver webhook:) (SKILL.md). - Sanitization: No evidence of content sanitization or validation of the fetched LoopNet data before processing by the agent is mentioned in the skill instructions.
Audit Metadata