printing-press

Warn

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates and executes code locally for verification purposes.
  • phases/01-preflight.md: Creates a temporary Go module (pp-go-stdlib-smoke) and runs it via go run . to verify the local toolchain.
  • phases/01-preflight.md: Rebuilds its own binary from source using go build if the local version is stale.
  • phases/11-build-the-goat.md: Uses codex exec --yolo to execute commands for code generation and task delegation.
  • [REMOTE_CODE_EXECUTION]: The setup process involves running commands that execute code from remote registries.
  • references/setup-checks.md: Instructs the agent to run npx -y skills@latest update to ensure all Printing Press skills are current. This involves executing code from the NPM registry.
  • [COMMAND_EXECUTION]: The skill relies on complex shell scripting for its internal logic.
  • phases/01-preflight.md: Contains a comprehensive Bash script for environment checks, path resolution, and toolchain validation.
  • references/fetch-docs.sh: A Bash utility that uses curl to retrieve documentation and source files for analysis.
  • [EXTERNAL_DOWNLOADS]: Fetches resources and configuration from external sources.
  • phases/01-preflight.md: Downloads a list of supported versions from raw.githubusercontent.com/mvanhorn/cli-printing-press/.
  • references/setup-checks.md: Directs the agent and user to install or update the main binary and skills via curl | bash and go install commands pointing to the author's GitHub repository.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 16, 2026, 09:46 PM
Security Audit — agent-trust-hub — printing-press