comtrade-minerals
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes legitimate requests to the official United Nations Comtrade API endpoints (
comtradeapi.un.org) to fetch global trade statistics. - [COMMAND_EXECUTION]: The skill uses the
bash_toolto performcurlrequests for data retrieval and simple text processing utilities likegrepandcutto manage configuration settings. - [DATA_EXPOSURE]: The skill references standard configuration paths for storing user API keys (
~/.config/comtrade/credentials) and environment variables (COMTRADE_API_KEY), following established security practices like advising restricted file permissions (chmod 600). - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface via API responses from UN Comtrade. It mitigates potential risks by parsing structured JSON data and mapping numeric codes to names using a localized reference table within the skill's own documentation.
Audit Metadata