goplaces
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
goplacescommand-line utility to perform location searches, resolve place names, and fetch place details or reviews. - [EXTERNAL_DOWNLOADS]: The skill installs the
goplacestool from the Homebrew tapsteipete/tap/goplaces. - [PROMPT_INJECTION]: The skill processes untrusted external data retrieved from the Google Places API, such as user-generated reviews and place descriptions, which introduces an indirect prompt injection surface.
- Ingestion points: Untrusted data enters the agent context through the output of
goplaces search,details, andreviewscommands. - Boundary markers: None. The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the API responses.
- Capability inventory: The skill is capable of executing the
goplacesCLI tool. - Sanitization: There is no evidence of filtering, escaping, or validation of the content returned by the Google Places API before it is processed by the agent.
Audit Metadata