geospatial-data-discovery

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The templates/pipeline.py script uses __import__ to load the json module within a function scope. This is a standard library import and is benign.
  • [DYNAMIC_EXECUTION]: In the examples/tartu-development/pipeline.py worked example, a Python script is dynamically generated and passed to a QGIS Docker container for project compilation. This is an intended functional capability for generating GIS desktop projects.
  • [COMMAND_EXECUTION]: The examples/tartu-development/pipeline.py script invokes docker via subprocess.run to compile QGIS projects. This execution is optional, guarded by an environment variable (OPENMAPSTACK_USE_QGIS_DOCKER), and uses a pinned version of the official QGIS container.
  • [EXTERNAL_DOWNLOADS]: The skill fetches datasets from authoritative Estonian government sources, including the Land and Spatial Development Board (Maa- ja Ruumiamet), the Environment Agency, and Tartu City GIS. These are trusted official providers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 10:08 AM
Security Audit — agent-trust-hub — geospatial-data-discovery