portaljs-add-dataset
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill fetches and follows an extended instruction workflow located at https://github.com/datopian/portaljs/blob/main/.claude/commands/portaljs-add-dataset.md. This is a vendor-owned resource hosted on GitHub used to orchestrate the dataset registration and routing process.- [COMMAND_EXECUTION]: Executes standard repository and project management commands including
git(for Git LFS tracking, local configuration, and pushing),npm/npx(for running the Next.js build process to verify the portal), andcurl(for fetching remote datasets).- [DATA_EXPOSURE_AND_EXFILTRATION]: Manages Arc account tokens and Giftless keys for Git LFS authentication. The skill follows security best practices by instructing the agent to store these credentials in the local repository configuration (lfs.url) instead of hardcoding them or committing them to the project.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests data from external URLs and local files to be registered as datasets. - Ingestion points: Dataset source URLs provided via
$ARGUMENTSand local file paths. - Boundary markers: None explicitly specified in the instructions to isolate potential instructions within the dataset content from the agent's context.
- Capability inventory: Has permissions to
Edit,Write, and executeBashcommands, primarily used for manifest updates and portal builds. - Sanitization: Implements format validation based on file extensions and HTTP
Content-Typeheaders to ensure only supported data types are processed.
Audit Metadata