add-geolocation

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill utilizes shell commands and Node.js execution to verify the presence of project files and validate dependencies. This includes running node -e for script-based logic and npx tsc for type-checking the generated code.
  • Indirect Prompt Injection Surface: This skill ingests data from local configuration files like package.json and power.config.json, as well as metadata from Dataverse environment APIs. While these are necessary for its function, they represent an entry point for external data into the agent's context.
  • Ingestion points: package.json, power.config.json, and metadata returned from Dataverse API via dataverse-request.js.
  • Boundary markers: None identified in the instruction set.
  • Capability inventory: The skill can execute shell commands (Bash), write new source files (Write), and edit existing files (Edit).
  • Sanitization: The skill performs basic JSON parsing and equality checks on the ingested data.
  • Dynamic Execution: The skill employs node -e to execute small JavaScript snippets at runtime to parse configuration and control flow. This pattern is used for environment resolution and package verification within the skill's operational steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 10:30 AM
Security Audit — agent-trust-hub — add-geolocation