cdc-voucher-locator-skill

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads merchant datasets (approximately 2MB) from the official GoWhere CDN (prd-tmp.cdn.gowhere.gov.sg) and retrieves geocoding data from the OneMap API (www.onemap.gov.sg). These are well-known official Singapore government domains.
  • [COMMAND_EXECUTION]: Executes a local Python helper script, cdc_voucher_locator.py, to perform distance calculations (Haversine formula) and filter merchants based on the user's location. The script uses standard libraries and manages a local data cache in ~/.hermes/cache/cdc-vouchers/.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from merchant listings and instructions encourage the agent to perform web research for food ratings, which are then interpolated into the final report.
  • Ingestion points: Merchant names/addresses from GoWhere and content from web searches for merchant ratings.
  • Boundary markers: No specific delimiters are used to wrap the external content in the final report.
  • Capability inventory: The skill writes to a local cache directory (~/.hermes/cache/cdc-vouchers/) and performs network requests to government APIs.
  • Sanitization: No explicit sanitization or filtering is performed on data retrieved from web searches before inclusion in the response.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 04:52 AM
Security Audit — agent-trust-hub — cdc-voucher-locator-skill