goplaces
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the goplaces command-line tool to perform location searches and fetch place details.
- [EXTERNAL_DOWNLOADS]: The skill references an external binary provided by the author, which is installed via a Homebrew tap (steipete/tap/goplaces). This is a vendor-owned resource.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes untrusted data from the Google Places API. 1. Ingestion points: Place search results, details, and reviews retrieved via the goplaces CLI. 2. Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the documentation. 3. Capability inventory: The skill is capable of executing shell commands through the goplaces binary. 4. Sanitization: No sanitization or validation of the retrieved API content is mentioned.
Audit Metadata