maproulette-tagfix

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a curl command to trigger challenge rebuilds on the official MapRoulette API (maproulette.org), which is a legitimate and documented administrative function.
  • [CREDENTIALS_UNSAFE]: Authentication is handled via standard placeholders and instructions to use environment variables or CI/CD secrets, following security best practices for credential management.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements Mustache templates for generating task instructions. This is a native feature of the targeted platform and the skill provides structured patterns to ensure consistent task identification.
  • [OBFUSCATION]: The mention of the RFC 7464 Record Separator (\x1E) is a technical requirement for the specific NDJSON format used by the service and does not constitute a malicious attempt to hide data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 03:31 AM