pp-uk-train-goat

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where user-provided inputs, such as station names and service identifiers, are interpolated into shell command arguments without explicit sanitization instructions.
  • Ingestion points: User-provided queries containing station names (e.g., <station>, <destination>) and service identifiers used in board, journey, and why commands.
  • Boundary markers: None present in the command instruction templates.
  • Capability inventory: The skill utilizes shell execution (Read Bash), performs network operations (API calls and optional webhooks), and manages local file storage (SQLite database and feedback logs).
  • Sanitization: No specific sanitization, validation, or escaping logic is defined for the natural language inputs before they are passed to the CLI.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to install the uk-train-goat-pp-cli tool using npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/.... These resources are managed by the skill's author/vendor.
  • [COMMAND_EXECUTION]: The skill uses the Read Bash tool to execute the uk-train-goat-pp-cli binary in the local environment to retrieve rail data and manage configurations.
  • [DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag, allowing the agent to route command output to arbitrary external URLs. Furthermore, a feedback mechanism is present that can transmit local data to a remote endpoint if specific environment variables (UK_TRAIN_GOAT_FEEDBACK_ENDPOINT) are configured.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 10:22 AM
Security Audit — agent-trust-hub — pp-uk-train-goat