fine-dust-location
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to an unverified external domain
k-skill-proxy.nomadamas.orgto fetch environmental data. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using
curland a local Python scriptscripts/fine_dust.pyto perform API calls and process data. - [DATA_EXFILTRATION]: User-supplied location hints (e.g., "서울 강남구") are sent as URL-encoded parameters to the external proxy server
k-skill-proxy.nomadamas.org. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it ingests and processes data from an untrusted external API.
- Ingestion points: Data returned from
https://k-skill-proxy.nomadamas.org/v1/fine-dust/report(SKILL.md). - Boundary markers: Absent; there are no instructions to delimit or ignore potential commands within the external data response.
- Capability inventory: Network requests via
curland local script executionscripts/fine_dust.py(SKILL.md). - Sanitization: Absent; no validation or escaping mechanisms for the external content are described.
Audit Metadata