yueyang-house
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
xiaolu-houseNode.js package usingnpx. This is the official CLI tool provided by the vendor for accessing their real estate services. - [COMMAND_EXECUTION]: Runs various subcommands of the
xiaolu-houseCLI to retrieve property data and manage settings. This includes commands for checking supported cities and configuring local parameters. - [SAFE]: Manages configuration data, including an encrypted API key, stored locally at
~/.xiaolu-house/config. This is a standard practice for CLI-based authentication and does not represent an unsafe exposure. - [PROMPT_INJECTION]: The skill processes property data and listing details retrieved from external sources through the CLI, which constitutes an indirect prompt injection surface.
- Ingestion points: Property listings, transaction data, and school information returned by the
xiaolu-housetool. - Boundary markers: Not explicitly defined; the agent is instructed to use natural language to summarize findings.
- Capability inventory: Execution of
npx -y xiaolu-housecommands. - Sanitization: None explicitly defined for the output of the CLI tool.
Audit Metadata