geobase-worker-osm-import

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill interacts with the geobase.app domain, which is the official infrastructure for the service described. All network operations are directed to these vendor-controlled endpoints for legitimate worker job management.- [SAFE]: The skill implements secure credential management by instructing the user to store the GEOBASE_SERVICE_ROLE_KEY in a local, gitignored .env.secrets file. This human-in-the-loop requirement ensures the agent does not directly handle or log the sensitive key.- [INDIRECT_PROMPT_INJECTION]: The skill processes external payload data which represents an ingestion surface.
  • Ingestion points: User-provided areaName and aoiGeoJson fields within the OSM import payload.
  • Boundary markers: The procedure includes mandatory validation steps for the session and payload checks before submission.
  • Capability inventory: The skill utilizes authenticated HTTP POST and GET requests to the Geobase worker API.
  • Sanitization: The tablePrefix field is validated against the strict regex ^[a-z][a-z0-9_]{0,62}$ to ensure data integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 10:01 AM