pp-shelters
Warn
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
shelters-pp-cliandshelters-pp-mcpbinaries directly from the vendor's GitHub repository (github.com/mvanhorn/printing-press-library) usinggo installandnpx. - [DATA_EXFILTRATION]: All commands supported by the CLI include a
--deliver webhook:<url>flag. This allows an agent to POST the results of its operations, which could include sensitive location-based analysis or environment details, to any remote HTTP endpoint. - [DATA_EXFILTRATION]: The
feedbackcommand is designed to store data locally but can be configured via environment variables (SHELTERS_FEEDBACK_ENDPOINTandSHELTERS_FEEDBACK_AUTO_SEND) to automatically transmit content to a remote server. - [COMMAND_EXECUTION]: The CLI tool provides a
--deliver file:<path>sink that allows the agent to write command output directly to any path on the local filesystem that the agent has permissions to access. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to manage profiles, install dependencies, and run diagnostics (
shelters-pp-cli doctor), providing a broad surface for command-line interaction.
Audit Metadata