search-charts
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external search API which is a potential entry point for indirect instructions.
- Ingestion points: Data is fetched via
curlfromhttps://ourworldindata.org/api/search. - Capability inventory: The skill is restricted to
curl,cat, andjqfor data handling and processing. - Sanitization: The instructions explicitly recommend using
jqto filter the API response to specific fields (title, subtitle, url), which significantly reduces the amount of untrusted content entering the agent's context window. - Boundary markers: Not explicitly used, but the use of structured JSON processing acts as a functional boundary.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
ourworldindata.orgto retrieve chart metadata. This is the official domain of the organization providing the data and is a well-known service for global statistics. The behavior is transparently documented and limited to the skill's primary search purpose.
Audit Metadata