jinko-vpop
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use Python-based CLI scripts (e.g.,
jinko.cli.create_vpop_from_csv,jinko.cli.inspect_vpop) to interact with the Jinkō platform. These are standard console scripts provided by the SDK. - [EXTERNAL_DOWNLOADS]: The documentation references the vendor's GitHub repository (
novainsilico/jinko-skills) as a source for supplemental skills. This is a legitimate vendor resource reference for platform setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from CSV and JSON files to generate or update virtual populations. While this represents a data ingestion surface, the skill includes explicit instructions for data validation, duplicate checking, and reviewing diagnostics before committing changes, which mitigates risk.
Audit Metadata