pp-xai
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install its core binary using
npxfrom the@mvanhornscope or viago installfrom the vendor's GitHub repository (github.com/mvanhorn/printing-press-library). These sources are consistent with the skill's author context. - [COMMAND_EXECUTION]: The skill's primary purpose is to execute the
xai-pp-clitool. It uses standard shell commands to verify installation (which xai-pp-cli) and perform API operations. User input is intended to be passed as arguments to this specific CLI tool. - [CREDENTIALS_SAFE]: The skill encourages the use of the
XAI_API_KEYenvironment variable for authentication, which is a recommended security practice. It includes anapi-keycommand designed to inspect credential health without exposing the actual secret value. - [DATA_EXFILTRATION]: The skill includes a
feedbackfeature, but the documentation explicitly states that it is local-only by default and only transmits data to a remote endpoint if specifically configured by the user via environment variables.
Audit Metadata