zoning-analysis-nyc
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external government APIs to generate reports.
- Ingestion points: The skill fetches lot and zoning data from NYC Open Data (data.cityofnewyork.us) and the MapPLUTO ArcGIS Feature Service (a841-dotweb01.nyc.gov) in SKILL.md Step 2.
- Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions for the data retrieved from the APIs.
- Capability inventory: The skill has access to Write, Edit, and Bash tools as defined in the SKILL.md frontmatter, and is specifically instructed to write analysis reports to the local file system (Step 8).
- Sanitization: No validation or sanitization logic for the external API content is specified in the workflow.
Audit Metadata