earth2studio-install
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Earth2Studio package and its various extras from PyPI and GitHub. This is the primary function of the skill and uses standard, trusted package management workflows.
- [PRIVILEGE_ESCALATION]: The instructions include troubleshooting steps that suggest using
sudo apt-getfor system dependencies (likelibeccodes-devandpython3-dev). The skill mitigates risks by strictly instructing the agent to never execute these commands itself, instead providing them for the user to run manually. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface where it fetches live installation documentation from an external URL to determine release versions and available model extras.
- Ingestion points: Fetches content from
https://nvidia.github.io/earth2studio/userguide/about/install.htmlvia WebFetch. - Boundary markers: The instructions do not define specific delimiters to separate the fetched content from the agent's system prompts.
- Capability inventory: The agent possesses the capability to generate shell commands (pip, uv, apt) and fetch web content.
- Sanitization: No explicit sanitization or validation logic is provided for the fetched documentation content, although it is sourced from a trusted vendor domain.
Audit Metadata