portaljs-connect-ckan

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references and fetches instructional content and workflows from the author's public repository at github.com/datopian/portaljs.
  • [DYNAMIC_EXECUTION]: The skill uses npx next build to verify the integrity of the project after generating the fetch client and modifying page templates.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs network requests to verify the reachability of a user-provided CKAN backend URL via API endpoints such as package_search and organization_show.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external CKAN API endpoints to populate portal content.
  • Ingestion points: Metadata is retrieved via package_search and package_show API calls described in SKILL.md and references/reference.md.
  • Boundary markers: The instructions do not specify explicit delimiters or warnings for the agent to ignore instructions embedded in the API data.
  • Capability inventory: The skill utilizes Read, Write, Edit, Bash(npx:*), and WebFetch tools.
  • Sanitization: The instructions do not define specific sanitization or validation logic for the metadata retrieved from the remote CKAN instance.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 04:57 AM