qgis-impl-web-services
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a technical reference and library of code snippets for PyQGIS development. It contains no malicious code, unauthorized command execution, or obfuscated content. It explicitly promotes security best practices regarding authentication configuration.- [PROMPT_INJECTION]: The skill provides instructions for loading data from remote OGC web services (WMS, WFS, WMTS). This creates an indirect prompt injection surface where untrusted data from an external server (such as feature attributes or metadata) could influence the agent if processed without further validation.
- Ingestion points: Remote OGC service responses handled by QgsRasterLayer and QgsVectorLayer in SKILL.md and references/examples.md.
- Boundary markers: None defined in the provided code snippets.
- Capability inventory: The documented patterns involve performing network requests to external services and writing rendered output to the local file system.
- Sanitization: Relies on standard QGIS API parsing and basic layer validation (e.g., layer.isValid()).
Audit Metadata