hawker-discover-skill
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a Python script from a sibling skill (cdc-voucher-locator-skill) using subprocess.run. The invocation uses a hardcoded relative path and passes arguments as a structured list, avoiding shell-based command injection risks.
- [EXTERNAL_DOWNLOADS]: The skill retrieves real-time data and datasets from official Singapore government APIs (api.data.gov.sg and api-open.data.gov.sg) and the OneMap geocoding service. These connections are made to well-known technology and public service domains for the legitimate purpose of data retrieval.
- [CREDENTIALS_UNSAFE]: The skill documentation and .env.example file correctly guide the user to manage API keys using environment variables and gitignored files, which is an industry-standard security practice.
Audit Metadata