blue-ribbon-nearby
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill specifies a dependency on an external Node.js package titled
blue-ribbon-nearby, which is required for the nearby search logic. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface (Category 8) where untrusted user data is processed to perform actions.
- Ingestion points: User-provided location strings (including landmarks, neighborhood names, or coordinates) are ingested as primary search parameters in
SKILL.md. - Boundary markers: The instructions do not define explicit boundary markers or delimiters to isolate user input from the agent's internal logic.
- Capability inventory: The skill executes network operations to the Blue Ribbon Survey website (
bluer.co.kr) and a proxy service (k-skill-proxy) to retrieve restaurant data. - Sanitization: No sanitization or validation steps for the user-supplied location strings are mentioned in the workflow.
Audit Metadata