portaljs-add-geo
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill executes native command-line tools including
ogr2ogr,tippecanoe, andduckdbvia shell commands. These commands use arguments such as file paths, slugs, and namespaces which are derived from user-provided input, posing a potential risk of command injection if parameters are not correctly handled. - [EXTERNAL_DOWNLOADS]: The skill is designed to fetch geospatial datasets from external URLs using
curl. It also references and follows instructions hosted in the author's public GitHub repository atgithub.com/datopian/portaljs. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (e.g., GeoJSON, CSV, Shapefiles) and reprojects or transforms it using native utilities.
- Ingestion points: The
sourceargument accepts local file paths or remote URLs containing geospatial data. - Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the content of the ingested geospatial files.
- Capability inventory: The skill has access to
Bash(git, curl, duckdb, ogr2ogr, tippecanoe),Write, andEdittools. - Sanitization: The skill relies on the internal parsing logic of GDAL, Tippecanoe, and DuckDB to handle the file formats safely.
Audit Metadata