pp-thelancet
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
thelancet-pp-cliandthelancet-pp-mcptools from external repositories. - Source:
github.com/mvanhorn/printing-press-libraryviago install. - Source:
@mvanhorn/printing-press-libraryvianpx. - [DATA_EXFILTRATION]: The CLI supports a
--deliver webhook:<url>parameter which POSTs command output to an arbitrary external URL. While a documented feature, this capability allows for the automated transmission of data to external endpoints. - [COMMAND_EXECUTION]: The skill uses the
Read Bashtool to executethelancet-pp-clicommands and perform installation tasks. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests article and author metadata from external academic sources (OpenAlex) via the CLI tool (e.g., in
SKILL.md). - Boundary markers: No explicit delimiters or boundary markers are defined for handling processed research data.
- Capability inventory: The skill has the capability to write output to local files (
--deliver file:<path>) and send data to network endpoints (--deliver webhook:<url>). - Sanitization: There is no documented sanitization or filtering of external article content before it is processed or delivered.
Audit Metadata