Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent World Bank data helper that makes disclosed read-only public API requests and does not show hidden persistence, credential access, or destructive behavior.
Install this if you want the agent to fetch public World Bank economic and development data. Be aware that country codes, indicator codes, date ranges, and search keywords may be sent to api.worldbank.org; avoid using it for confidential query terms if that is a concern.
The skill clearly instructs the agent to perform outbound network access to the World Bank API, but the manifest shown does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens policy enforcement and reviewability because a user or platform cannot tell from the declaration that external network access is required.
The description says to use this skill for any macroeconomic statistics, country comparison, development indicator, or historical country data task, even when the World Bank is not mentioned. That broad trigger scope can cause the skill to activate for many general requests and unnecessarily send user queries or derived parameters to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import urllib.request
BASE = "https://api.worldbank.org/v2"
ALIASES = {
"gdp": "NY.GDP.MKTP.CD",
No suspicious patterns detected.