pp-air-quality

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes external installation methods to provision the necessary CLI tool.
  • Evidence: Instructs installation via npx -y @mvanhorn/printing-press-library install air-quality --cli-only and go install github.com/mvanhorn/printing-press-library/library/other/air-quality/cmd/air-quality-pp-cli@latest.
  • Note: These resources are hosted within the verified vendor's namespace (@mvanhorn on NPM and mvanhorn on GitHub).
  • [COMMAND_EXECUTION]: The skill requires the execution of the air-quality-pp-cli binary to function.
  • Evidence: Provides various commands for current snapshots, sensor history, and location comparisons.
  • Context: Tool usage is restricted to the specific CLI designed for this skill.
  • [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external APIs.
  • Ingestion points: Data enters the agent context from the OpenAQ and AirNow API services via the CLI output.
  • Boundary markers: No explicit boundary markers or isolation warnings are used when processing the external API results.
  • Capability inventory: The skill is configured with the Read Bash tool.
  • Sanitization: There is no evidence of specific sanitization or filtering of the API-returned content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 01:40 PM
Security Audit — agent-trust-hub — pp-air-quality