blue-ribbon-nearby
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation specifies a dependency on a custom Node.js package named
blue-ribbon-nearby. This package is required to execute the location resolution and search logic. - [DATA_EXFILTRATION]: The skill requests sensitive user location data, such as precise GPS coordinates or specific landmarks, and transmits this information to an external service named
k-skill-proxyat the endpoint/v1/blue-ribbon/nearby. While this is part of the intended functionality, it involves sending PII to a non-standard third-party service. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes data from both user inputs and external restaurant survey endpoints.
- Ingestion points: User-supplied location strings/coordinates and JSON data retrieved from
bluer.co.krdomains. - Boundary markers: Absent. The instructions do not define delimiters to protect the agent from instructions embedded in the external data or user location input.
- Capability inventory: The skill uses a Node.js module to perform network requests and manipulate local data.
- Sanitization: Absent. The skill does not mention validation or sanitization steps for the data fetched from external URLs or provided by the user.
Audit Metadata