alterlab-yokatlas
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to download the yokatlas-py package from the Python Package Index (PyPI) at runtime, which is required for its primary data retrieval function.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a local helper script, scripts/yokatlas_lookup.py, to perform university list lookups and program statistics searches.
- [INDIRECT_PROMPT_INJECTION]: The skill consumes external data from the YÖK Atlas JSON API, creating a theoretical attack surface for indirect prompt injection.
- Ingestion points: University and admission statistics are fetched from the yokatlas.yok.gov.tr API endpoints.
- Boundary markers: The skill does not employ specific delimiters to isolate the untrusted API data from the agent's system instructions.
- Capability inventory: The skill environment permits file system operations and command execution via Bash.
- Sanitization: The script outputs structured JSON data from the API but does not perform content-level sanitization of the values before they are passed to the agent context.
Audit Metadata