earth2studio-data-fetch
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch documentation and lexicon files from official NVIDIA sources (nvidia.github.io and github.com/NVIDIA). These are trusted vendor repositories used to ensure accuracy of API signatures and variable support.
- [COMMAND_EXECUTION]: The skill generates Python scripts that utilize the 'earth2studio' library to fetch data. These scripts are intended for user execution to retrieve weather datasets and do not perform unauthorized system operations.
- [CREDENTIALS_UNSAFE]: The skill references the standard location for the Climate Data Store (CDS) API key (~/.cdsapirc) as a prerequisite for specific data sources. It does not attempt to read or exfiltrate this file, but correctly identifies it as a configuration requirement for the underlying library.
- [DATA_EXFILTRATION]: While the skill involves network access to remote data stores (GCS, S3, CDS API), this is the primary intended function of fetching weather data. No patterns of sensitive data exfiltration to unauthorized domains were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it fetches content from external GitHub and documentation pages to guide code generation. However, since these sources are official vendor-controlled repositories, the risk is negligible.
Audit Metadata