pp-substack-reader
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install CLI and MCP binaries using npx (from @mvanhorn/printing-press-library) and go install (from github.com/mvanhorn/printing-press-library). These sources are owned by the skill's vendor.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands via the Read Bash tool. It implements a 'Learning Loop' feature (recall, teach, playbook) where the agent is instructed to synthesize and execute sequences of commands (playbooks) based on a local journal of previous interactions.
- [DATA_EXFILTRATION]: The underlying CLI tool supports a --deliver webhook flag that allows command output to be POSTed to an external URL. Additionally, the skill includes a feedback mechanism that can be configured to send data to a remote endpoint via the SUBSTACK_READER_FEEDBACK_ENDPOINT environment variable.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting external data from Substack publications and processing user queries through a learning loop. This loop generates command sequences (playbooks). Ingestion points: Substack publications; Boundary markers: Playbook.notes instructions; Capability inventory: bash command execution; Sanitization: No explicit sanitization of ingested content is documented.
Audit Metadata