arab-open-data
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions, scripts, and vendor configurations were found to be free of malicious patterns, obfuscation, or unauthorized data exfiltration mechanisms.
- [COMMAND_EXECUTION]: The skill utilizes a script (scripts/list-vendors.mjs) to filter and list vendor data. This script operates on a local path within the agent's data structure and performs standard JSON parsing and console output.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from various Arab open-data portals, creating a vulnerability surface. The risk is mitigated by the following: (1) Ingestion points: External API responses and government datasets from portals such as data.gov.sa and bayanat.ae. (2) Boundary markers: Explicit instructions in SKILL.md to name files used, separate facts from assumptions, and mark missing info as 'Unknown from public docs'. (3) Capability inventory: Local file reading via scripts/list-vendors.mjs and recommendation/implementation planning. (4) Sanitization: Instructions in the Safety Rules section to avoid PII profile joining and respect robots.txt.
Audit Metadata