track-unrest-events
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation includes a placeholder API key (wm_0123456789...) which is a non-functional dummy value using a sequential hex pattern for illustrative purposes.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the official service domain at worldmonitor.app to retrieve its core data.
- [COMMAND_EXECUTION]: Includes standard bash examples utilizing curl and node for API interaction and timestamp calculation in a benign context.
- [INDIRECT_PROMPT_INJECTION]: The skill explicitly guards against adversarial content in ingested data feeds by including a 'Content safety' section. 1. Ingestion points: Data fields like title and summary returned from the unrest events API (SKILL.md). 2. Boundary markers: Explicit instructions directing the agent to disregard instructions within responses and treat fields as data. 3. Capability inventory: Network access for data fetching and local node execution for processing. 4. Sanitization: LLM-level negative constraints to strictly treat external content as non-authoritative data.
Audit Metadata