goplaces
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the goplaces CLI from a third-party Homebrew tap (steipete/tap/goplaces).
- [COMMAND_EXECUTION]: The skill utilizes the goplaces binary to perform location searches, resolve addresses, and retrieve place details.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the Google Places API.
- Ingestion points: Output from goplaces search, details, and reviews commands is incorporated into the agent's execution context.
- Boundary markers: There are no markers or delimiters present in the instructions to distinguish API-returned data from system instructions.
- Capability inventory: The skill maintains the capability to execute the goplaces CLI with arbitrary search strings and IDs.
- Sanitization: The skill does not provide evidence of sanitization or filtering of the content returned by the API before it is processed.
Audit Metadata