reproducible-gis-project
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Several Python scripts in the example projects (
analysis.py,delivery.py,routing.py,qgis_delivery.py) use thesubprocessmodule to execute external GIS utilities and build tools, includingdbt,npm,valhalla, anddocker. These operations are fundamental to the skill's purpose of managing complex spatial data pipelines and are implemented securely using argument lists rather than shell execution. - [EXTERNAL_DOWNLOADS]: The pipeline scripts (
pipeline.py,routing.py) are designed to download spatial data snapshots from authoritative domains such ass3.pilw.io(Maa- ja Ruumiamet mirror),gsavalik.envir.ee(ETAK Environment Agency), anddownload.geofabrik.de(OSM regional extracts). The skill also performs standard package management operations usingpipandnpmfor integration toolchains. - [DATA_EXPOSURE]: The skill documents and enforces rigorous standards for credential management in
references/user-data-sources.md. It explicitly prohibits the storage of hardcoded secrets within project manifests, requiring the use of environment variable or system service references instead.
Audit Metadata