alterlab-geomaster

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches satellite imagery and configuration data from well-known scientific and technology services, including the ESA Copernicus Data Space, USGS EarthExplorer, Microsoft Planetary Computer, and Google Earth Engine (references/data-sources.md).
  • [EXTERNAL_DOWNLOADS]: Provides guidance for downloading geospatial dataset archives from trusted sources such as Natural Earth (via Amazon S3) and OpenStreetMap (references/data-sources.md).
  • [COMMAND_EXECUTION]: Includes code examples for integrating with specialized GIS software (SAGA GIS) by executing command-line operations through the Python subprocess module (references/gis-software.md).
  • [CREDENTIALS_UNSAFE]: Uses standard documentation placeholders such as 'YOUR_API_KEY', 'password', and 'aws_access_key_id' in code examples to instruct users on where to provide their own credentials for cloud storage and API access (SKILL.md, references/data-sources.md).
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted data from various geospatial file formats (GeoJSON, Shapefiles, GeoTIFF, etc.) which are processed by powerful capabilities including file system writes and network API calls.
  • Ingestion points: External geospatial files processed across multiple reference files (references/core-libraries.md, references/scientific-domains.md).
  • Boundary markers: Not utilized in the instructional code examples.
  • Capability inventory: Includes file system write operations (to_file, to_raster) and external command execution (subprocess.run).
  • Sanitization: No explicit validation or sanitization of ingested file content is shown in the examples, relying on library-level parsing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 02:50 PM
Security Audit — agent-trust-hub — alterlab-geomaster