openplanter
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches investigative data from official government portals (including SEC, FEC, US Census, EPA, and OSHA) and well-known data providers (ICIJ, ProPublica, and OpenSanctions). These are reputable sources and the downloads are performed using the standard Python library.
- [COMMAND_EXECUTION]: The skill uses subprocess calls to orchestrate its analysis pipeline and to integrate with peer skills such as 'exa-search'. These calls use secure list-based argument passing, preventing shell-injection vulnerabilities. The tools invoked (e.g., exa_search.py, openplanter-agent) are either part of the skill suite or established peer skills.
- [CREDENTIALS_UNSAFE]: The skill correctly manages API keys by reading them from environment variables (e.g., ANTHROPIC_API_KEY, FEC_API_KEY, SAM_GOV_API_KEY). No hardcoded credentials or secrets were found in the scripts or metadata.
- [SAFE]: The skill includes extensive documentation and instructions regarding epistemic discipline and verification principles. It explicitly directs the agent to verify all data transformations, avoid confirmation bias using Analysis of Competing Hypotheses (ACH), and maintain clear provenance for all findings. These architectural decisions significantly reduce the risk of indirect prompt injection and analytical errors.
Audit Metadata