reading-portolan
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches geospatial metadata and datasets from 'data.source.coop'. Source Cooperative is a well-known and trusted repository for public geospatial data.
- [COMMAND_EXECUTION]: The skill provides instructions for using standard command-line utilities such as 'duckdb', 'ogr2ogr', and 'gpio' for processing and converting geospatial data. These are legitimate tools used as intended for the skill's primary purpose.
- [REMOTE_CODE_EXECUTION]: An automated scanner flagged a command piping data to Python. However, analysis shows the command 'curl ... | python3 -m json.tool' is a standard method for pretty-printing JSON in the terminal and does not execute the input as code.
- [EXTERNAL_DOWNLOADS]: Installation instructions refer to official package managers and registries including Homebrew and PyPI (e.g., 'pip install duckdb', 'pipx install geoparquet-io').
Audit Metadata