pp-vestaboard

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the vestaboard-pp-cli and vestaboard-pp-mcp binaries to interact with the hardware. These are purpose-built tools for the skill's functionality. It also allows for user-provided arguments in commands like vestaboard-pp-cli <command> [subcommand] [args] --agent.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core CLI components from the author's GitHub repository (github.com/mvanhorn/printing-press-library) and via npm (@mvanhorn/printing-press-library). These are vendor-owned resources necessary for the skill to function. The skill also interacts with official service domains: cloud.vestaboard.com, vbml.vestaboard.com, and web.vestaboard.com for authentication and message formatting.
  • [DATA_EXFILTRATION]: The skill includes a --deliver webhook:<url> feature that can POST command output to a user-specified URL. While this is a documented feature for automation, it represents a potential channel for data transfer if misconfigured or used maliciously by an agent. The skill also mentions a feedback mechanism that can send data to VESTABOARD_FEEDBACK_ENDPOINT if explicitly enabled.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 10:21 AM
Security Audit — agent-trust-hub — pp-vestaboard