planet
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a pre-defined Node.js script (planet-api.js) to interact with Planet's services. It does not utilize subprocesses or dynamic shell execution for its operations.
- [CREDENTIALS_UNSAFE]: The implementation follows security best practices by keeping API credentials on the host machine. The skill interacts with a host-side proxy that injects the necessary authorization headers, ensuring the API key never enters the sandboxed environment.
- [DATA_EXFILTRATION]: Network activity is restricted to a local proxy endpoint (10.200.0.1), preventing arbitrary data transmission to unknown external domains. The proxy enforces access controls, such as blocking order placement (POST) requests.
- [PROMPT_INJECTION]: The skill documentation includes constraints (DO NOT instructions) designed to guide the agent toward safe and efficient tool usage rather than attempting to bypass safety filters or override core behavior.
- [DATA_EXPOSURE]: The skill ingests data from external API responses via the proxy. While this represents a potential surface for indirect prompt injection, the risk is mitigated as the script parses the data into structured JSON objects and does not evaluate it as code.
Audit Metadata