pp-offerup
Warn
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
offerup-pp-clibinary usingnpx -y @mvanhorn/printing-press-libraryandgo install github.com/mvanhorn/printing-press-library/.... While these originate from the vendor's infrastructure as defined in the author context, they constitute external code dependencies from a non-globally-trusted source. - [REMOTE_CODE_EXECUTION]: The skill encourages the installation and execution of external binaries (
offerup-pp-cli,offerup-pp-mcp) at runtime. Running these tools allows the execution of code not contained within the skill file itself. - [DATA_EXFILTRATION]: The CLI tool includes a
--deliver webhook:<url>flag, allowing command results to be POSTed to any external URL. This provides a direct mechanism for data exfiltration if the agent is manipulated into using it. - [CREDENTIALS_UNSAFE]: The skill manages sensitive OfferUp session cookies via the
auth login --chromecommand and theOFFERUP_COOKIEenvironment variable. The handling, storage, and potential exposure of these authentication tokens are security-sensitive operations. - [COMMAND_EXECUTION]: The skill requires the
Bashtool to execute the CLI commands. This exposes a surface for command injection if the agent interpolates unsanitized user input into the shell commands. - [DATA_EXFILTRATION]: The skill processes untrusted data from external OfferUp listings, creating an indirect prompt injection surface.
- Ingestion points: External listing data (titles, descriptions, prices) is fetched via
listings search,listings get, andseller-scancommands. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat listing content as untrusted data.
- Capability inventory: The skill uses the
Bashtool to executeofferup-pp-cli, which has the ability to write to files (--deliver file:<path>) and send data over the network (--deliver webhook:<url>). - Sanitization: There is no evidence of sanitization or filtering of the external data before it is returned to the agent context.
Audit Metadata