pp-air-quality
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes external installation methods to provision the necessary CLI tool.
- Evidence: Instructs installation via
npx -y @mvanhorn/printing-press-library install air-quality --cli-onlyandgo install github.com/mvanhorn/printing-press-library/library/other/air-quality/cmd/air-quality-pp-cli@latest. - Note: These resources are hosted within the verified vendor's namespace (@mvanhorn on NPM and mvanhorn on GitHub).
- [COMMAND_EXECUTION]: The skill requires the execution of the
air-quality-pp-clibinary to function. - Evidence: Provides various commands for current snapshots, sensor history, and location comparisons.
- Context: Tool usage is restricted to the specific CLI designed for this skill.
- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external APIs.
- Ingestion points: Data enters the agent context from the OpenAQ and AirNow API services via the CLI output.
- Boundary markers: No explicit boundary markers or isolation warnings are used when processing the external API results.
- Capability inventory: The skill is configured with the
Read Bashtool. - Sanitization: There is no evidence of specific sanitization or filtering of the API-returned content before it is processed by the agent.
Audit Metadata