cdc-voucher-locator-skill
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads merchant datasets (approximately 2MB) from the official GoWhere CDN (
prd-tmp.cdn.gowhere.gov.sg) and retrieves geocoding data from the OneMap API (www.onemap.gov.sg). These are well-known official Singapore government domains. - [COMMAND_EXECUTION]: Executes a local Python helper script,
cdc_voucher_locator.py, to perform distance calculations (Haversine formula) and filter merchants based on the user's location. The script uses standard libraries and manages a local data cache in~/.hermes/cache/cdc-vouchers/. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from merchant listings and instructions encourage the agent to perform web research for food ratings, which are then interpolated into the final report.
- Ingestion points: Merchant names/addresses from GoWhere and content from web searches for merchant ratings.
- Boundary markers: No specific delimiters are used to wrap the external content in the final report.
- Capability inventory: The skill writes to a local cache directory (
~/.hermes/cache/cdc-vouchers/) and performs network requests to government APIs. - Sanitization: No explicit sanitization or filtering is performed on data retrieved from web searches before inclusion in the response.
Audit Metadata