pp-vestaboard
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
vestaboard-pp-cliandvestaboard-pp-mcpbinaries to interact with the hardware. These are purpose-built tools for the skill's functionality. It also allows for user-provided arguments in commands likevestaboard-pp-cli <command> [subcommand] [args] --agent. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core CLI components from the author's GitHub repository (
github.com/mvanhorn/printing-press-library) and via npm (@mvanhorn/printing-press-library). These are vendor-owned resources necessary for the skill to function. The skill also interacts with official service domains:cloud.vestaboard.com,vbml.vestaboard.com, andweb.vestaboard.comfor authentication and message formatting. - [DATA_EXFILTRATION]: The skill includes a
--deliver webhook:<url>feature that can POST command output to a user-specified URL. While this is a documented feature for automation, it represents a potential channel for data transfer if misconfigured or used maliciously by an agent. The skill also mentions a feedback mechanism that can send data toVESTABOARD_FEEDBACK_ENDPOINTif explicitly enabled.
Audit Metadata