bok-ecos-stats
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
npxutility to fetch and execute the vendor's management tool,@nomadamas/k-skill, from the public NPM registry. - [COMMAND_EXECUTION]: Shell commands are employed to run the
npxutility for retrieving skill instructions, listing files, and performing updates. - [INDIRECT_PROMPT_INJECTION]: The skill ingests economic statistics from the official Bank of Korea ECOS API and processes them as text output for the agent.
- Ingestion points: The
scripts/bok_ecos.pyscript fetches data from theecos.bok.or.krdomain. - Boundary markers: No specific delimiters are used to wrap the API output in the rendered text.
- Capability inventory: The Python helper is a read-only script with no file-write, command-execution, or subprocess capabilities beyond the initial network request.
- Sanitization: The script parses JSON but does not sanitize the resulting strings for potential embedded instructions before display.
Audit Metadata