tongliao-house
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the xiaolu-house package from the npm registry. This is a standard method for accessing Node-based CLI tools.
- [COMMAND_EXECUTION]: The skill interacts with the user by executing xiaolu-house shell commands. This includes querying property listings and displaying configuration data.
- [PROMPT_INJECTION]: The skill handles property listings and descriptions from an external service, which creates a potential surface for indirect prompt injection.
- Ingestion points: Real estate listings and market data retrieved via the CLI (SKILL.md).
- Boundary markers: None are specified to separate external data from agent instructions.
- Capability inventory: Shell command execution using npx (SKILL.md).
- Sanitization: The instructions do not specify any validation or sanitization for the data retrieved from the platform.
Audit Metadata