skills/getedgehq/skills/data-globe/Gen Agent Trust Hub

data-globe

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/bootstrap.py utility downloads the MapLibre GL JS library (v5.24.0) from the well-known unpkg.com CDN during the initial setup process.
  • Evidence: Calls urllib.request.urlretrieve for the library's JS, CSS, and license files.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external location data (CSV/JSON), which represents a potential surface for indirect prompt injection if malicious instructions are embedded in the dataset.
  • Ingestion points: The scripts/prepare.py script reads user-provided datasets from the file system.
  • Boundary markers: Data processing is constrained by a required field mapping and validation logic in the preparation script.
  • Capability inventory: The skill can generate local files, process images via the Pillow library, and serve the resulting visualization through a local HTTP server.
  • Sanitization: template/app.js implements a safeURL function that filters external links to allow only standard web protocols, and scripts/prepare.py performs type checking and range validation on coordinate and weight fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:08 AM