authoritative-data-harvester

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/run.py performs HTTP GET requests to external URLs specified in the configuration file data_requirements.json to download datasets and scrape web content using the requests and pandas libraries.
  • [COMMAND_EXECUTION]: The skill executes a Python script to automate the data retrieval and processing workflow, which involves file system operations and network requests.
  • [DATA_EXFILTRATION]: No exfiltration patterns were detected. The script is configured to fetch information from external sources into the local environment; there is no logic for sending sensitive local files or credentials to external servers.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external web sources, which is a common attack surface for indirect prompt injection.
  • Ingestion points: The scripts/run.py file reads data from arbitrary URLs via requests.get and pd.read_html.
  • Boundary markers: SKILL.md provides instructions for the agent to respect robots.txt, follow service terms, and prioritize authoritative sources, acting as an operational guideline.
  • Capability inventory: The script scripts/run.py has the capability to perform network GET requests and write files to the local crawled_data/ directory.
  • Sanitization: The script performs basic processing such as converting tables to CSV format and saving raw data to a specific subdirectory, though it does not explicitly sanitize for malicious instructions within the data itself.
  • [SAFE]: The skill's behavior aligns with its documented purpose of collecting authoritative data from well-known international organizations. It includes explicit instructions to respect site constraints and avoid bypassing security measures.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 12:32 PM