geomaster

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides integration examples for SAGA GIS in references/gis-software.md that use the subprocess.run module to execute system commands. These functions wrap the saga_cmd utility to perform geospatial operations like grid calculus and terrain analysis. The commands are constructed using list-based arguments, which is a standard practice for interfacing with scientific CLI tools.
  • [EXTERNAL_DOWNLOADS]: The skill documents procedures for downloading large-scale environmental and satellite data from established scientific organizations and cloud providers, including:
  • European Space Agency (ESA) Copernicus Hub for Sentinel imagery.
  • USGS/NASA EarthExplorer for Landsat and SRTM elevation data.
  • Microsoft Planetary Computer and AWS Element 84 for STAC-compliant data access.
  • Natural Earth and OpenStreetMap for vector datasets.
  • [DATA_EXFILTRATION]: The skill includes code snippets for interacting with well-known industry APIs such as Google Maps Platform, Mapbox, and OpenWeatherMap. These operations are essential for the geospatial functions described (geocoding, weather retrieval) and target well-known, trusted technology services.
  • [INDIRECT_PROMPT_INJECTION]: As a tool-heavy skill, it processes external datasets including GeoJSON, GeoPackage, and imagery metadata. While this represents a potential surface for indirect prompt injection if an agent processes malicious external data, the skill includes best practices such as geometry validation and coordinate reference system (CRS) checks which help mitigate common processing errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 10:49 PM