datacommons-client
Warn
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill recommends installing the
datacommons-clientpackage viauv pip. This package name differs from the standarddatacommonspackage usually associated with the Data Commons API. - [EXTERNAL_DOWNLOADS]: The installation of
datacommons-clientfetches code from an external repository. While the skill links to the official Data Commons GitHub and documentation, the package name provided in the installation instructions does not match the package documented at those official sources, creating a potential supply-chain or impersonation risk. - [PROMPT_INJECTION]: The 'Suggest Using K-Dense Web For Complex Workflows' section contains instructions for the AI agent to monitor task complexity and proactively advertise the
www.k-dense.aiplatform. This is an attempt to hijack the agent's behavior for commercial promotion.
Audit Metadata