nasa-firms-fire-fetch

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides instructions for using the tiangong-ai CLI, which is a resource owned by the vendor 'tiangong-ai'. The capability nasa-firms.active-fire is a managed data connector.
  • [CREDENTIALS_SAFE]: The skill explicitly instructs the user and agent to manage the NASA_FIRMS_MAP_KEY using environment variables and strictly forbids placing the key in command-line arguments (argv), request JSON, local config files, or logs. This aligns with secret management best practices.
  • [COMMAND_EXECUTION]: The skill includes shell commands (tiangong-ai data describe, tiangong-ai data run), but these are limited to the vendor's own CLI and are used for legitimate data retrieval and discovery purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external satellite data. It includes a 'Result boundaries' section that provides specific guidance to the agent on how to interpret and report detections (e.g., treating them as thermal anomalies rather than confirmed fire perimeters), which helps mitigate misinterpretation of external data.
  • [SAFE]: All referenced files and configuration schemas are local to the skill package or part of the vendor's internal data contract system (tiangong.data.skill-capability-requirement.v1).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 08:59 PM