jinko-solution-and-product-guide
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a JSON model library from
https://doc.jinko.ai/model-library.json. This is a vendor-controlled domain (Nova In Silico / Jinkō) and the operation is documented as a primary function for retrieving catalog metadata. - [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/search_model_library.py. This script is part of the skill package and implements defensive measures including size limits on responses, strict JSON schema validation, and host pinning to prevent SSRF or unexpected redirects. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external
model-library.jsonfile. The risk is mitigated by strict field validation (ensuring all fields are strings) and the use of the data for informational catalog purposes only, without feeding it into high-privilege execution sinks. - [DYNAMIC_EXECUTION]: The skill uses
json.loadsto parse the fetched library. The implementation includes type checking and bounds checking to ensure the data adheres to the expected scientific model schema.
Audit Metadata