sdmx-explorer
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the
opensdmxandduckdbCLIs. Parameters such as keywords, geographic codes, and filter values derived from user input are interpolated into these commands (e.g.,opensdmx search "<keyword>",opensdmx get <id> --geo <code>).- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install the DuckDB CLI tool from its official domain (install.duckdb.org) and references various official SDMX REST endpoints for data retrieval.- [REMOTE_CODE_EXECUTION]: The documentation provides a pattern for installing DuckDB viacurl -fsSL https://install.duckdb.org | sh, which involves downloading and executing a script from a remote server.- [PROMPT_INJECTION]: The skill processes structured and metadata-heavy data from external SDMX providers (Category 8). While the sources are official statistical organizations, the skill lacks explicit sanitization or boundary markers when handling external data that influences subsequent shell command construction and agent reasoning.
Audit Metadata