kelly-dog-walk
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches real-time and historical weather data from official Open-Meteo API domains (geocoding-api.open-meteo.com, historical-forecast-api.open-meteo.com, and archive-api.open-meteo.com). These downloads are intrinsic to the skill's purpose of calculating dog-walk decisions based on real weather judges.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external weather data and database records, creating a surface for indirect injection if the source data were compromised.
- Ingestion points: Weather data is ingested in
scripts/lib/open-meteo.mjsfrom the Open-Meteo API. Record data is ingested inscripts/lib/busabase.mjsfrom Busabase bases. - Boundary markers: None explicitly present in the prompt templates, but data is handled via structured objects.
- Capability inventory: The skill can perform network requests and write to Busabase bases (primarily through a ChangeRequest mechanism requiring human approval).
- Sanitization: External weather data is parsed into numeric types and validated against strict schemas in
content/kelly-dog-walk-app/app/js/walk-model.jsbefore being used in decision logic.
Audit Metadata