add-geolocation
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- Command Execution: The skill utilizes shell commands and Node.js execution to verify the presence of project files and validate dependencies. This includes running
node -efor script-based logic andnpx tscfor type-checking the generated code. - Indirect Prompt Injection Surface: This skill ingests data from local configuration files like
package.jsonandpower.config.json, as well as metadata from Dataverse environment APIs. While these are necessary for its function, they represent an entry point for external data into the agent's context. - Ingestion points:
package.json,power.config.json, and metadata returned from Dataverse API viadataverse-request.js. - Boundary markers: None identified in the instruction set.
- Capability inventory: The skill can execute shell commands (
Bash), write new source files (Write), and edit existing files (Edit). - Sanitization: The skill performs basic JSON parsing and equality checks on the ingested data.
- Dynamic Execution: The skill employs
node -eto execute small JavaScript snippets at runtime to parse configuration and control flow. This pattern is used for environment resolution and package verification within the skill's operational steps.
Audit Metadata