portaljs-connect-ckan
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references and fetches instructional content and workflows from the author's public repository at
github.com/datopian/portaljs. - [DYNAMIC_EXECUTION]: The skill uses
npx next buildto verify the integrity of the project after generating the fetch client and modifying page templates. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs network requests to verify the reachability of a user-provided CKAN backend URL via API endpoints such as
package_searchandorganization_show. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external CKAN API endpoints to populate portal content.
- Ingestion points: Metadata is retrieved via
package_searchandpackage_showAPI calls described inSKILL.mdandreferences/reference.md. - Boundary markers: The instructions do not specify explicit delimiters or warnings for the agent to ignore instructions embedded in the API data.
- Capability inventory: The skill utilizes
Read,Write,Edit,Bash(npx:*), andWebFetchtools. - Sanitization: The instructions do not define specific sanitization or validation logic for the metadata retrieved from the remote CKAN instance.
Audit Metadata