shiny-locations
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes an integration,
Shiny.Locations.Extensions.AI, that enables LLM agents to access sensitive user location data through tool functions. - Ingestion points: The
get_current_locationtool returnsGpsReadingdata, including latitude, longitude, and altitude, directly into the agent's context (described inSKILL.md). - Boundary markers: The documentation notes that these tools are read-only and requires developers to explicitly opt-in via
AddLocationAIToolregistration. - Capability inventory: The exposed tools are limited to retrieving location status (
get_current_location) or performing geographic calculations (get_distance_to,estimate_travel_time). No write or command execution capabilities are granted to the agent. - Sanitization: Tool results are returned as structured
JsonNodeobjects using hand-built schemas to ensure AOT compatibility and data consistency.
Audit Metadata