ccupp-password-profiler
Warn
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the installation of the
ccupptool from a GitHub repository (https://github.com/WangYihang/ccupp.git) that is not identified as a trusted source. - [COMMAND_EXECUTION]: The skill provides commands to install and execute software using
f8xandpipx, which involves running code from external sources on the local system. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process highly sensitive personal information (PII) including names, phone numbers, and identity numbers. There is a risk of indirect prompt injection if the agent is instructed to collect this information from untrusted external sources, which could lead to data poisoning or unintended dictionary generation.
Audit Metadata