fuel-pricing
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
fuel_prices.pyscript implements a sophisticated geolocation flow that starts a temporary local HTTP server on a random port and opens the system's default web browser. This allows the skill to request high-accuracy GPS coordinates via the browser's Geolocation API, similar to authentication flows in CLI tools likeghorgcloud. - [EXTERNAL_DOWNLOADS]: The skill fetches data from multiple external services to provide its core functionality. These include the Western Australian Government's FuelWatch API, the NSW Government's FuelCheck API, community aggregators like PetrolSpy, and a Supabase-backed service for FuelSnoop. It also uses OpenStreetMap's Nominatim service for geocoding addresses.
- [CREDENTIALS_UNSAFE]: The skill includes instructions and code to manage official government API credentials. If provided by the user, keys are stored in
~/.config/fuel-pricing/credentials.json. The script correctly applies restricted file permissions (chmod 600) to ensure the secrets are only accessible by the owner. - [DATA_EXFILTRATION]: To perform its search, the skill transmits user location data (coordinates or place names) to external third-party services. This is a required component of the skill's primary function and is performed transparently through standard API requests.
- [SAFE]: The Python script uses
uv runwith declared dependencies (httpx), which ensures a predictable and isolated execution environment. Price data is sanitized to filter out unrealistic values, and no execution of arbitrary remote code was detected.
Audit Metadata