world-bank-data
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Fetches development indicators from the World Bank's official Open Data API using
curl. This is the primary function of the skill. - [REMOTE_CODE_EXECUTION]: The skill includes an example where the output of a
curlcommand is piped to apython3 -cone-liner. The Python code is a static script provided within the skill that performs safe JSON parsing of data received from the World Bank API; it does not download or execute scripts from a remote server. - [DATA_EXFILTRATION]: Performs network requests to
api.worldbank.orgto fetch public statistics. No sensitive environment variables, credentials, or local system files are accessed. - [PROMPT_INJECTION]: The skill processes external data from the World Bank API, which constitutes an indirect injection surface.
- Ingestion points: Data retrieved from
api.worldbank.orgused in formatting examples inSKILL.md. - Boundary markers: None identified.
- Capability inventory:
curlfor network access andpython3for data processing. - Sanitization: None; the skill performs simple field extraction and printing.
Audit Metadata