cheap-gas-nearby

Fail

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill requires the agent to execute npx -y @nomadamas/k-skill@0 instruct cheap-gas-nearby as the first step to retrieve its primary instructions. This pattern executes code from an external registry (NPM) at runtime, allowing the skill's behavior to be changed dynamically by a remote source.
  • [COMMAND_EXECUTION]: Instructions provide multiple shell commands using npx for fetching files and updating the skill (npx -y @nomadamas/k-skill@0 files and update), which encourages the agent to run potentially unverified scripts.
  • [EXTERNAL_DOWNLOADS]: The skill fetches fuel price data through a third-party proxy at https://k-skill-proxy.nomadamas.org/v1/opinet/around rather than connecting directly to official sources, introducing a dependency on intermediate infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external content from Kakao Map and Opinet to find gas station details.
  • Ingestion points: Fetches data from m.map.kakao.com and place-api.map.kakao.com for location resolution.
  • Boundary markers: None identified to distinguish between fuel price data and potential instructions embedded in external strings.
  • Capability inventory: The skill has the ability to perform network requests and execute shell commands via the provided npx instructions.
  • Sanitization: No explicit sanitization or validation of the remote content is described before it is formatted into the agent's response.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 1, 2026, 02:40 PM