world-bank-data

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Fetches development indicators from the World Bank's official Open Data API using curl. This is the primary function of the skill.
  • [REMOTE_CODE_EXECUTION]: The skill includes an example where the output of a curl command is piped to a python3 -c one-liner. The Python code is a static script provided within the skill that performs safe JSON parsing of data received from the World Bank API; it does not download or execute scripts from a remote server.
  • [DATA_EXFILTRATION]: Performs network requests to api.worldbank.org to fetch public statistics. No sensitive environment variables, credentials, or local system files are accessed.
  • [PROMPT_INJECTION]: The skill processes external data from the World Bank API, which constitutes an indirect injection surface.
  • Ingestion points: Data retrieved from api.worldbank.org used in formatting examples in SKILL.md.
  • Boundary markers: None identified.
  • Capability inventory: curl for network access and python3 for data processing.
  • Sanitization: None; the skill performs simple field extraction and printing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 11:31 PM
Security Audit — agent-trust-hub — world-bank-data