mobility-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
WebSearchandWebFetchto gather information from official transit authorities (MTA, NJ Transit), government portals (NYC Open Data, FAA, USDOT), and recognized services (Walk Score). These operations are core to the skill's function and target well-known, reputable domains. - [INDIRECT_PROMPT_INJECTION]: The skill presents a potential indirect prompt injection surface as it ingests content from external websites via the
WebFetchtool. Ingestion points: Web content retrieved during the research workflow described inSKILL.md. Boundary markers: No specific delimiters or 'ignore' instructions are used for fetched content. Capability inventory: The skill possessesWritecapabilities to create local markdown reports and access to theBashtool as defined in theallowed-toolsfrontmatter ofSKILL.md. Sanitization: The agent is instructed to extract specific data points into a pre-defined markdown template, which limits the likelihood of executing instructions embedded in external content.
Audit Metadata