pp-sculptok
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs a CLI tool and MCP server from the vendor's GitHub repository (
github.com/mvanhorn/printing-press-library). These are official project resources. - [COMMAND_EXECUTION]: The skill executes shell commands using the
sculptok-pp-clibinary to perform image-to-3D conversions and manage credits. These operations are restricted to the tool's intended purpose. - [DATA_EXFILTRATION]: The skill includes an optional webhook delivery mechanism (
--deliver webhook:<url>) which allows users to POST command output to a specified URL. This is a documented feature for workflow automation rather than a hidden exfiltration vector.
Audit Metadata