geomaster
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: A thorough review of the skill's instructions, metadata, and the bundled
scripts/raster_workflows.pyscript revealed no malicious patterns, obfuscation, or unauthorized access to sensitive data. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process third-party geospatial data from various external APIs and catalogs, which represents a potential attack surface for indirect injection.
- Ingestion points: Geospatial data and STAC metadata retrieved from providers described in
SKILL.mdandreferences/data-sources.md. - Boundary markers: Data is processed primarily as numeric arrays or structured GeoJSON/GeoPackage formats, which naturally separates data content from the agent's control flow.
- Capability inventory: The skill has the capability to write local files via
scripts/raster_workflows.pyand perform network operations to access Earth observation catalogs. - Sanitization: Relies on established GIS libraries (Rasterio, Fiona, GeoPandas) that perform rigorous schema validation and format-specific parsing.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of configuration and imagery assets from well-known technology services and trusted organizations, including Microsoft (Planetary Computer), AWS (Earth Search), and the European Space Agency (Copernicus).
Audit Metadata