bccard-eatpl-search

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute its own instructions, file lists, and updates from the @nomadamas/k-skill package. It also points to the source instructions on a public GitHub repository belonging to the same organization (github.com/NomaDamas/k-skill). These are functional requirements for the skill's distribution and maintenance.
  • [COMMAND_EXECUTION]: The skill executes a local JavaScript helper scripts/kakao-place-rating.mjs using npx -y @nomadamas/k-skill@0 exec. This script performs legitimate lookups of Kakao Map ratings by fetching data from a configured proxy and public search pages. The input parameters (--name, --address) are derived from the BC Card API response and handled as arguments to the script.
  • [DATA_EXPOSURE]: The instructions contain strict rules forbidding the output of internal implementation details, such as endpoint URLs, API tokens, status codes, or internal database field names. It explicitly warns against asking for or storing plaintext credentials.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (BC Card merchant info and Kakao Map ratings). However, it includes mandatory formatting and 'Done when' criteria that act as boundary markers to ensure the agent only outputs a specific table format and does not interpret the data as new instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 02:40 PM