pp-woolworths

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the woolworths-pp-cli tool using npx with the @mvanhorn/printing-press-library package and via go install from the vendor's GitHub repository.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands via the woolworths-pp-cli binary to search products, browse categories, and manage a guest cart.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external retail data and search results. It implements a local 'learning loop' where the agent is instructed to follow 'playbooks' and 'notes' retrieved from a local SQLite database, which could be influenced by processed content.
  • Ingestion points: Woolworths catalogue search results and product detail endpoints processed by the CLI.
  • Boundary markers: None explicitly defined for isolating retail data from instructions within the learning loop.
  • Capability inventory: Uses Bash to execute the CLI and performs file operations on a local SQLite database (data.db) and log files.
  • Sanitization: No specific sanitization or filtering of processed retail data is described before it is stored or recalled to influence agent playbooks.
  • [DYNAMIC_EXECUTION]: The 'Playbook' system involves dynamically assembling and replaying command steps with slot substitution based on stored learnings in a local database.
  • [DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> flag for routing output and a feedback command for sending telemetry to a remote endpoint. The auth login --chrome feature also enables the import of browser session cookies to access personal retail surfaces.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 03:24 PM
Security Audit — agent-trust-hub — pp-woolworths