pp-ucp
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions and automation for downloading and installing software from external sources using
npxandgo install. - The
npx -y @mvanhorn/printing-press-library install ucp --cli-onlycommand downloads and executes code from the npm registry. - The
go installcommands fetch and compile source code fromgithub.com/mvanhorn/printing-press-library. - [COMMAND_EXECUTION]: The skill relies on the
Bashtool to execute theucp-pp-clibinary and manage MCP server registration viaclaude mcp add. - [DATA_EXFILTRATION]: The CLI includes a
--deliver webhook:<url>flag that allows the agent to POST command results directly to an external URL. This provides a direct capability for exfiltrating processed commerce data or sensitive command outputs to untrusted endpoints.
Audit Metadata