pp-us-data
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading and installing the
us-data-pp-cliutility. Instructions provide two methods: usingnpxto run a package from the@mvanhorn/printing-press-libraryNPM registry or usinggo installto fetch the source fromgithub.com/mvanhorn/printing-press-library. These resources are associated with the identified vendor. - [COMMAND_EXECUTION]: The skill is designed to execute the
us-data-pp-clibinary via the shell to perform data lookups (e.g.,us-data-pp-cli cpi --agent). - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface (Category 8) because it fetches data from external public APIs (BLS, Census, BEA).
- Ingestion points: Data is retrieved from external government APIs via the CLI and returned to the agent.
- Boundary markers: Not explicitly defined in the prompt instructions.
- Capability inventory: The skill uses
Bashto execute the CLI tool. - Sanitization: The CLI tool uses an
--agentflag to provide structured JSON output, which assists in safe parsing by the agent, though the markdown does not specify internal sanitization of the API responses.
Audit Metadata