geopolitical-risk
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches datasets from external academic and organizational sources, including the GPR Index from matteoiacoviello.com and conflict data via the ACLED API.- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection attack surface (Category 8) because it ingests untrusted content from external APIs, databases, and news articles to be processed by the agent without implementing defensive boundaries.
- Ingestion points: External data enters the agent context through the GPR_DATA_URL, ACLED_API_BASE, BigQuery event queries, and news content fetched via the read_url tool.
- Boundary markers: No specific delimiters or instructions to ignore embedded directives are provided in the analytical framework.
- Capability inventory: The skill scripts use requests.get, pd.read_excel, and google.cloud.bigquery to retrieve information for analysis.
- Sanitization: The provided code snippets do not include logic for filtering, escaping, or validating the ingested content before it is processed.
Audit Metadata