local-places
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires a
GOOGLE_PLACES_API_KEYfor its core functionality. The implementation correctly retrieves this from environment variables usingos.getenvrather than hardcoding it in the source files. - [EXTERNAL_DOWNLOADS]: The skill setup involves downloading standard Python packages from PyPI, including
fastapi,httpx, anduvicorn. These are widely used, reputable libraries for building and running web services. - [COMMAND_EXECUTION]: The documentation provides instructions to run shell commands (using
uvanduvicorn) to host a local server on127.0.0.1. This execution is confined to the local machine and is necessary for the skill's proxy architecture. - [DATA_EXFILTRATION]: Network requests are directed to
https://places.googleapis.com, which is the official endpoint for a well-known service (Google). No suspicious or unauthorized data transmission to unknown third parties was detected.
Audit Metadata