cli-anything-geoai
Warn
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and download of geospatial datasets (such as NAIP and Overture) from remote sources via the
data searchanddata downloadcommands. - [COMMAND_EXECUTION]: The skill operates as a comprehensive CLI wrapper providing access to system diagnostics, file system management, and complex geospatial processing routines.
- [DYNAMIC_EXECUTION]: The skill loads machine learning models (e.g.,
model.pth) and batch processing configurations (config.yaml). Loading serialized model files, particularly PyTorch.pthfiles, often utilizes deserialization methods (likepickle) that can execute arbitrary code if the loaded file is from an untrusted source. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests various external file formats including raster imagery (
.tif,.jpg), vector data (.geojson), and YAML configurations. - Boundary markers: While output is structured as JSON, the skill does not explicitly define boundary markers or 'ignore' instructions for data processed during segmentation or classification tasks.
- Capability inventory: The harness possesses capabilities for file system writes, network downloads, and model training/execution via subprocess calls.
- Sanitization: No explicit sanitization or validation logic for external metadata or configuration content is documented.
Audit Metadata