pp-xai
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
xai-pp-clitool usingnpxfrom the@mvanhorn/printing-press-librarypackage on the NPM registry or viago installfrom the author's GitHub repository (github.com/mvanhorn/printing-press-library). These resources are owned by the skill's author. - [REMOTE_CODE_EXECUTION]: The installation process involves executing code directly from remote package managers (
npx) and source repositories (go install). These are standard installation procedures for the provided CLI and originate from the author's own infrastructure. - [DATA_EXFILTRATION]: The CLI includes a
--deliver webhook:<url>feature that allows the agent to POST command results to an arbitrary external URL. While intended for automation, this represents a potential surface for data exfiltration if the agent is directed to send sensitive API output to an untrusted endpoint. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute numerous subcommands via thexai-pp-clibinary. These commands interact with xAI's REST API to manage models, files, chat completions, and image/video generation.
Audit Metadata