geocoder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- PROMPT_INJECTION (LOW): The skill processes untrusted input from CSV files and strings to perform geocoding. Evidence: 1. Ingestion points:
geocode_csvandbatch_geocodefunctions in SKILL.md. 2. Boundary markers: Absent in documentation and examples. 3. Capability inventory: Network requests via geopy and file I/O via pandas. 4. Sanitization: Not specified in provided files. - EXTERNAL_DOWNLOADS (SAFE): The dependencies
geopyandpandasspecified in scripts/requirements.txt are trusted, well-known packages in the Python ecosystem. - DATA_EXFILTRATION (LOW): The skill performs network operations to external providers (Nominatim, Google, Bing) that are not on the whitelisted domains list. This is necessary for geocoding but constitutes transmission of address data to third-party services.
Audit Metadata