address-finder

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install the @ideal-postcodes/address-finder and @ideal-postcodes/address-finder-bundled packages via npm. It also demonstrates how to load the bundled version from the jsDelivr CDN (e.g., https://cdn.jsdelivr.net/npm/@ideal-postcodes/address-finder-bundled). These resources belong to the vendor and are hosted on a well-known service.
  • [COMMAND_EXECUTION]: Code snippets include the use of npm install for dependency management. These commands are standard for the development workflows described in the skill.
  • [SAFE]: The skill demonstrates secure development practices by instructing users to use public API keys (ak_*) for frontend work and providing troubleshooting advice for common security issues like Content Security Policy (CSP) headers and domain whitelisting (allowed URLs).
  • [SAFE]: The skill implementation involves processing user input and third-party API data. While specific boundary markers are absent in the examples, the functionality is constrained to address lookups and form population via the vendor's API.
  • Ingestion points: HTML input fields defined by CSS selectors such as #searchField in references/react.md or #input in references/separate-input.md.
  • Boundary markers: None explicitly defined in the provided code snippets.
  • Capability inventory: Performs browser-based network requests to the vendor's API (api.ideal-postcodes.co.uk) and updates form field values via the DOM.
  • Sanitization: Standard library behavior; no additional developer-side sanitization is shown in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 10:48 AM