pp-usgs-earthquakes
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests live earthquake data from the USGS API, which is an external and untrusted source. Ingestion points: The
feeds,events, andwatchcommands retrieve data from remote USGS summary feeds. Capability inventory: The skill has the ability to execute shell hooks (--notify), write output to files (--deliver file:), and send data to network endpoints (--deliver webhook:). Boundary markers: The CLI promotes the use of structured output flags like--jsonand--agentto ensure predictable parsing of results. Sanitization: Results are wrapped in a provenance envelope and formatted as JSON to differentiate data from instructions. - [COMMAND_EXECUTION]: The
watchcommand supports a--notifyparameter that enables the execution of user-defined shell commands when seismic events are detected. - [EXTERNAL_DOWNLOADS]: The skill instructs users to install dependencies from the vendor's organization via
go installfor GitHub repositories andnpxfor NPM packages.
Audit Metadata