used-car-price-search
Warn
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires a Node.js package named
used-car-price-search. This package is not a standard, well-known library, nor does it appear to be a verified resource from the author, which may introduce unverified code into the execution environment. - [PROMPT_INJECTION]: The skill processes data from an external source, creating a surface for potential indirect prompt injection.
- Ingestion points: The skill fetches data from the SK Direct inventory page at
https://www.skdirect.co.kr/tb. - Boundary markers: No delimiters or safety instructions are defined to separate the external inventory data from the agent's instructions.
- Capability inventory: The skill is capable of making network requests and parsing structured data from HTML.
- Sanitization: There is no evidence of sanitization or validation of the fetched web content before it is processed by the agent.
Audit Metadata