pp-tripadvisor
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
tripadvisor-pp-cliandtripadvisor-pp-mcptools from the vendor's official GitHub repository (github.com/mvanhorn/printing-press-library) usinggo install. - [EXTERNAL_DOWNLOADS]: Downloads and executes an installer from the vendor's npm package (
@mvanhorn/printing-press-library) vianpx. - [DATA_EXFILTRATION]: Includes a
--deliver webhook:<url>flag that allows command output to be POSTed to external URLs, provided as a documented data routing feature. - [DATA_EXFILTRATION]: Supports an automated feedback submission feature that sends locally stored notes to a remote server defined by the
TRIPADVISOR_FEEDBACK_ENDPOINTenvironment variable. - [COMMAND_EXECUTION]: Invokes the
tripadvisor-pp-clibinary to perform all search, comparison, and detail retrieval tasks. - [PROMPT_INJECTION]: Potential surface for indirect prompt injection through the processing of external Tripadvisor Content API data.
- Ingestion points: Retrieves traveler reviews and photo metadata from the Tripadvisor API via
reviewsanddigestcommands. - Boundary markers: None explicitly defined in the skill instructions to delimit or ignore instructions within API data.
- Capability inventory: The tool can perform network POST operations (webhooks, feedback) and write output to local files.
- Sanitization: No specific sanitization or filtering logic is described for the user-generated review content before it is returned to the agent context.
Audit Metadata