pp-netlify

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs the netlify-pp-cli and netlify-pp-mcp tools from the author's public GitHub repository and NPM package. These are documented as vendor-owned resources and are necessary for the skill's stated purpose.
  • [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands using the netlify-pp-cli binary. This is the primary function of the skill and is restricted to the tools specified in the frontmatter.
  • [DATA_EXFILTRATION]: The CLI tool includes a --deliver webhook:<url> feature that can send command output to an external URL. While this is a documented capability of the underlying tool, users should be aware that it allows for the transmission of account metadata (sites, deploys, DNS records) to external endpoints if invoked with a remote URL.
  • [DATA_EXPOSURE]: The skill processes account-wide data from Netlify, including environment variables and form submissions. The submissions search and env-drift commands handle potentially sensitive information by mirroring it to a local SQLite database for offline auditing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 09:18 AM
Security Audit — agent-trust-hub — pp-netlify