skills/cjakma/k-skill/zipcode-search/Gen Agent Trust Hub

zipcode-search

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a Python script that invokes the curl utility via the subprocess module. This is a standard method for interacting with web services within the agent environment and is used here to perform address queries.
  • [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET requests to the official South Korean postal service domain (parcel.epost.go.kr) to retrieve postal code information. This connection is used strictly for the skill's documented purpose and targets a well-known public service endpoint.
  • [PROMPT_INJECTION]: The skill retrieves and processes external HTML data, which represents a potential surface for indirect prompt injection.
  • Ingestion points: Data is fetched into the page variable from the curl output in SKILL.md.
  • Boundary markers: No explicit instructions are used to separate the external content from the agent's instructions, though the data is filtered via regex.
  • Capability inventory: The skill uses subprocess.run to call curl and write results to stdout.
  • Sanitization: The skill uses html.unescape before displaying results, though the raw HTML is primarily processed via structured regular expressions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 05:48 AM
Security Audit — agent-trust-hub — zipcode-search