search-stac
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes Python scripts via
python3 -cusing the Bash tool to interface with geospatial APIs. These scripts are dynamically generated by interpolating user-provided arguments into command templates, which constitutes a potential indirect injection surface. 1. Ingestion points: User-provided arguments in$@. 2. Boundary markers: Absent in the Python code templates. 3. Capability inventory: Execution of arbitrary Python code and local file system access. 4. Sanitization: No explicit sanitization or escaping of input strings is performed before interpolation into the script string. - [EXTERNAL_DOWNLOADS]: Fetches satellite imagery and metadata from the Microsoft Planetary Computer STAC catalog. The skill uses the
geoailibrary to manage these remote requests and stores downloaded data in a local directory (./stac_data/).
Audit Metadata