fuel-pricing

Pass

Audited by Gen Agent Trust Hub on Mar 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The fuel_prices.py script implements a sophisticated geolocation flow that starts a temporary local HTTP server on a random port and opens the system's default web browser. This allows the skill to request high-accuracy GPS coordinates via the browser's Geolocation API, similar to authentication flows in CLI tools like gh or gcloud.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from multiple external services to provide its core functionality. These include the Western Australian Government's FuelWatch API, the NSW Government's FuelCheck API, community aggregators like PetrolSpy, and a Supabase-backed service for FuelSnoop. It also uses OpenStreetMap's Nominatim service for geocoding addresses.
  • [CREDENTIALS_UNSAFE]: The skill includes instructions and code to manage official government API credentials. If provided by the user, keys are stored in ~/.config/fuel-pricing/credentials.json. The script correctly applies restricted file permissions (chmod 600) to ensure the secrets are only accessible by the owner.
  • [DATA_EXFILTRATION]: To perform its search, the skill transmits user location data (coordinates or place names) to external third-party services. This is a required component of the skill's primary function and is performed transparently through standard API requests.
  • [SAFE]: The Python script uses uv run with declared dependencies (httpx), which ensures a predictable and isolated execution environment. Price data is sanitized to filter out unrealistic values, and no execution of arbitrary remote code was detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 16, 2026, 06:25 AM