pp-ucp

Warn

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and automation for downloading and installing software from external sources using npx and go install.
  • The npx -y @mvanhorn/printing-press-library install ucp --cli-only command downloads and executes code from the npm registry.
  • The go install commands fetch and compile source code from github.com/mvanhorn/printing-press-library.
  • [COMMAND_EXECUTION]: The skill relies on the Bash tool to execute the ucp-pp-cli binary and manage MCP server registration via claude mcp add.
  • [DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> flag that allows the agent to POST command results directly to an external URL. This provides a direct capability for exfiltrating processed commerce data or sensitive command outputs to untrusted endpoints.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 8, 2026, 08:22 PM
Security Audit — agent-trust-hub — pp-ucp