nhc-active-cyclones
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions provide a fallback command to download the
call.mjsutility from the vendor's domainhttps://fittings.sh/skill/call.mjs. This is a vendor-managed resource provided by the skill author. - [COMMAND_EXECUTION]: The skill uses a Node.js script (
call.mjs) to handle network requests, JSON parsing, and cryptographic signing. The script is used by the agent to interact with the Fittings.sh service and is configured via environment variables. - [PROMPT_INJECTION]: The skill ingests hurricane advisory data from an external source (NOAA via Fittings.sh) and processes it into the agent's context, representing a surface for indirect prompt injection.
- Ingestion points: Fetches advisories from
fittings.sh/v1/nhc/active-cyclonesusingfetchincall.mjs. - Boundary markers: None; output is logged directly to the console for the agent to read.
- Capability inventory: The skill can perform network requests and sign data using a private key.
- Sanitization: The script performs JSON validation but does not sanitize the text content for potential embedded instructions.
Audit Metadata