printing-press-score
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to execute shell commands, including a setup script and the 'printing-press scorecard' command. It resolves directory paths from user input and passes them as arguments to these commands.
- [COMMAND_EXECUTION]: The setup script dynamically modifies the 'PATH' environment variable ('export PATH="$_scope_dir:$PATH"') to prioritize a local binary found in the project's root directory. This behavior is intended to support local development builds of the tool.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install an external binary using 'go install github.com/mvanhorn/cli-printing-press/v4/cmd/printing-press@latest'. This targets the official repository of the tool's author.
- [DATA_EXFILTRATION]: The skill reads local configuration files such as 'state.json' and 'spec.json' to retrieve metadata about projects. This data is used locally to generate the markdown scoring tables and is not observed being sent to external endpoints.
Audit Metadata