maps
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches location, routing, and timezone data from established services including OpenStreetMap (Nominatim), the Overpass API, OSRM, and TimeAPI.io.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external web APIs, which serves as a potential attack surface for indirect prompt injection if the source data is compromised.
- Ingestion points: The
scripts/maps_client.pyscript performs network requests to Nominatim, Overpass, OSRM, and TimeAPI APIs. - Boundary markers: The skill instructions do not provide explicit delimiters or instructions to the agent to treat the returned data as untrusted content.
- Capability inventory: The included Python script only outputs structured JSON data to standard output and does not possess capabilities for file writing, persistence, or arbitrary shell command execution.
- Sanitization: The script extracts and formats specific data fields from the JSON API responses before presenting them, providing a layer of validation against arbitrary content in the response body.
Audit Metadata