geobase-worker-geoai-embeddings
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a canonical model registry from a remote URL hosted on GitHub Gists (
gist.githubusercontent.com/mhassanch/...). This introduces a dependency on external data that is not managed within the skill's own repository. - [COMMAND_EXECUTION]: The skill executes shell-based commands including
gdalinfoandgeobase-cli. The instruction to rungdalinfo "<geotiffPath>"uses double quotes to wrap the user-provided path, which is a basic precaution but may not prevent command injection if the underlying shell environment interprets subshells or variables within the quotes. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided inputs such as
geotiffPath,project_ref, and various payload parameters are processed and used as arguments in shell commands and network requests. - Boundary markers: While the procedure specifies quoting variables, there are no explicit boundary markers or instructions for the agent to sanitize input strings for shell-sensitive characters (e.g., backticks, dollar signs).
- Capability inventory: The skill possesses the capability to execute arbitrary shell commands via the CLI tools, read file metadata, and perform authenticated network operations (POST/GET) to external application endpoints (
geobase.app). - Sanitization: The skill lacks explicit sanitization or validation logic for the
geotiffPathbeyond simple existence and format checks, leaving a potential surface for injection if the path string is maliciously crafted.
Audit Metadata