tracking-pettracer-location
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
pettracer_cli.pyandpettracer_watch.py) to interact with the PetTracer API. These scripts are helper tools that perform REST and WebSocket operations, returning structured JSON results to the agent. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
aiohttplibrary as specified inscripts/requirements.txt. This is a standard, well-known Python package used for handling asynchronous network requests. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the PetTracer API, which acts as an untrusted ingestion point. Maliciously crafted data in fields such as pet names could theoretically influence the agent's behavior. \n
- Ingestion points: External API responses are parsed in
scripts/pettracer_cli.pyandscripts/pettracer_watch.py.\n - Boundary markers: The instructions define a specific JSON output format, but no explicit text delimiters or 'ignore' instructions are used for API-sourced strings.\n
- Capability inventory: The skill uses subprocess calls to execute its own Python scripts and performs network communication.\n
- Sanitization: No explicit sanitization or filtering of API-returned text fields is implemented before presentation to the agent.
Audit Metadata