sourcecoop
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes instructions to verify and configure AWS profiles for Source Cooperative by checking
~/.aws/credentialsand managing local.envfiles. These activities are limited to the specific 'source' profile required for the service. - [COMMAND_EXECUTION]: Orchestrates workflows using the
portolanCLI and standard shell commands (grep,cat,mkdir,mv) for data organization and cataloging. - [DATA_EXFILTRATION]: Directs data to
s3://us-west-2.opendata.source.coop/, the official endpoint for Source Cooperative, a well-known open data commons managed by the Radiant Earth Foundation. - [PROMPT_INJECTION]: The skill processes
metadata.yamlfiles to generate documentation. While this creates a surface for indirect prompt injection, the skill uses validation tools to maintain schema integrity. - Ingestion points: User-provided geospatial files and
metadata.yaml. - Boundary markers: Not specified in the current skill instructions.
- Capability inventory: File system writes, command execution, and network uploads.
- Sanitization: Uses the
portolan metadata validatecommand to enforce metadata standards.
Audit Metadata