maproulette-tagfix
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a curl command to trigger challenge rebuilds on the official MapRoulette API (maproulette.org), which is a legitimate and documented administrative function.
- [CREDENTIALS_UNSAFE]: Authentication is handled via standard placeholders and instructions to use environment variables or CI/CD secrets, following security best practices for credential management.
- [INDIRECT_PROMPT_INJECTION]: The skill implements Mustache templates for generating task instructions. This is a native feature of the targeted platform and the skill provides structured patterns to ensure consistent task identification.
- [OBFUSCATION]: The mention of the RFC 7464 Record Separator (\x1E) is a technical requirement for the specific NDJSON format used by the service and does not constitute a malicious attempt to hide data.
Audit Metadata