geobase-worker-osm-import
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts with the
geobase.appdomain, which is the official infrastructure for the service described. All network operations are directed to these vendor-controlled endpoints for legitimate worker job management.- [SAFE]: The skill implements secure credential management by instructing the user to store theGEOBASE_SERVICE_ROLE_KEYin a local, gitignored.env.secretsfile. This human-in-the-loop requirement ensures the agent does not directly handle or log the sensitive key.- [INDIRECT_PROMPT_INJECTION]: The skill processes external payload data which represents an ingestion surface. - Ingestion points: User-provided
areaNameandaoiGeoJsonfields within the OSM import payload. - Boundary markers: The procedure includes mandatory validation steps for the session and payload checks before submission.
- Capability inventory: The skill utilizes authenticated HTTP POST and GET requests to the Geobase worker API.
- Sanitization: The
tablePrefixfield is validated against the strict regex^[a-z][a-z0-9_]{0,62}$to ensure data integrity.
Audit Metadata