pp-xai

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the xai-pp-cli tool using npx from the @mvanhorn/printing-press-library package on the NPM registry or via go install from the author's GitHub repository (github.com/mvanhorn/printing-press-library). These resources are owned by the skill's author.
  • [REMOTE_CODE_EXECUTION]: The installation process involves executing code directly from remote package managers (npx) and source repositories (go install). These are standard installation procedures for the provided CLI and originate from the author's own infrastructure.
  • [DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature that allows the agent to POST command results to an arbitrary external URL. While intended for automation, this represents a potential surface for data exfiltration if the agent is directed to send sensitive API output to an untrusted endpoint.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute numerous subcommands via the xai-pp-cli binary. These commands interact with xAI's REST API to manage models, files, chat completions, and image/video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 08:14 PM
Security Audit — agent-trust-hub — pp-xai