delivery-tracking
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Uses shell commands including
curl,python3,mktemp, andrmto interact with courier websites and manage temporary data files. These operations are restricted to retrieving and formatting tracking information. - [EXTERNAL_DOWNLOADS]: Fetches tracking status and session tokens from official domains:
www.cjlogistics.comandservice.epost.go.kr. These are well-known official services necessary for the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external HTML and JSON data from third-party logistics websites. It mitigates potential injection risks by using specific regex patterns and JSON parsing to extract only the required logistics data (status, location, timestamps) before presenting it to the agent.
Audit Metadata