sdmx-explorer

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to interact with the opensdmx and duckdb CLIs. Parameters such as keywords, geographic codes, and filter values derived from user input are interpolated into these commands (e.g., opensdmx search "<keyword>", opensdmx get <id> --geo <code>).- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install the DuckDB CLI tool from its official domain (install.duckdb.org) and references various official SDMX REST endpoints for data retrieval.- [REMOTE_CODE_EXECUTION]: The documentation provides a pattern for installing DuckDB via curl -fsSL https://install.duckdb.org | sh, which involves downloading and executing a script from a remote server.- [PROMPT_INJECTION]: The skill processes structured and metadata-heavy data from external SDMX providers (Category 8). While the sources are official statistical organizations, the skill lacks explicit sanitization or boundary markers when handling external data that influences subsequent shell command construction and agent reasoning.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 06:37 AM