air-quality
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API, which could theoretically contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Reads JSON data from the Open-Meteo geocoding and air-quality APIs (SKILL.md).
- Boundary markers: None specified to separate API data from system instructions.
- Capability inventory: Uses shell command execution (
curl) to fetch data (SKILL.md). - Sanitization: No explicit validation or filtering of the remote API content is described.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute
curlcommands in the shell to interact with web APIs. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
air-quality-api.open-meteo.comandgeocoding-api.open-meteo.com. These are well-known technology services and the usage is consistent with the skill's primary purpose.
Audit Metadata