geospatial-viewers
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the execution of several CLI utilities (viewtif, viewgeom, viewinline) used for geospatial and tabular data analysis.
- [EXTERNAL_DOWNLOADS]: The skill recommends using uvx to execute tools. This implicitly involves downloading the relevant Python packages from PyPI at runtime. These packages (viewtif, viewgeom, viewinline) are authored by the skill's creator, aligning with standard vendor practices.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection due to the tools' ability to process external files and execute complex queries.
- Ingestion points: Tools like viewgeom and viewinline ingest untrusted geospatial and tabular data files from paths provided as command-line arguments (referenced in SKILL.md, references/viewgeom.md, and references/viewinline.md).
- Boundary markers: No explicit boundary markers or instructions to sanitize file-based inputs are provided in the skill documentation.
- Capability inventory: The tools support dynamic operations such as pandas query execution (--filter) and DuckDB SQL query execution (--duckdb, --sql, --where), as documented in references/viewgeom.md and references/viewinline.md.
- Sanitization: The documentation does not describe any built-in sanitization, escaping, or validation for the inputs passed to these querying flags.
Audit Metadata