portaljs-add-dataset

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill fetches and follows an extended instruction workflow located at https://github.com/datopian/portaljs/blob/main/.claude/commands/portaljs-add-dataset.md. This is a vendor-owned resource hosted on GitHub used to orchestrate the dataset registration and routing process.- [COMMAND_EXECUTION]: Executes standard repository and project management commands including git (for Git LFS tracking, local configuration, and pushing), npm/npx (for running the Next.js build process to verify the portal), and curl (for fetching remote datasets).- [DATA_EXPOSURE_AND_EXFILTRATION]: Manages Arc account tokens and Giftless keys for Git LFS authentication. The skill follows security best practices by instructing the agent to store these credentials in the local repository configuration (lfs.url) instead of hardcoding them or committing them to the project.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests data from external URLs and local files to be registered as datasets.
  • Ingestion points: Dataset source URLs provided via $ARGUMENTS and local file paths.
  • Boundary markers: None explicitly specified in the instructions to isolate potential instructions within the dataset content from the agent's context.
  • Capability inventory: Has permissions to Edit, Write, and execute Bash commands, primarily used for manifest updates and portal builds.
  • Sanitization: Implements format validation based on file extensions and HTTP Content-Type headers to ensure only supported data types are processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 04:57 AM