nasa-firms-fire-fetch
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for using the
tiangong-aiCLI, which is a resource owned by the vendor 'tiangong-ai'. The capabilitynasa-firms.active-fireis a managed data connector. - [CREDENTIALS_SAFE]: The skill explicitly instructs the user and agent to manage the
NASA_FIRMS_MAP_KEYusing environment variables and strictly forbids placing the key in command-line arguments (argv), request JSON, local config files, or logs. This aligns with secret management best practices. - [COMMAND_EXECUTION]: The skill includes shell commands (
tiangong-ai data describe,tiangong-ai data run), but these are limited to the vendor's own CLI and are used for legitimate data retrieval and discovery purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external satellite data. It includes a 'Result boundaries' section that provides specific guidance to the agent on how to interpret and report detections (e.g., treating them as thermal anomalies rather than confirmed fire perimeters), which helps mitigate misinterpretation of external data.
- [SAFE]: All referenced files and configuration schemas are local to the skill package or part of the vendor's internal data contract system (
tiangong.data.skill-capability-requirement.v1).
Audit Metadata