d2b-notice-search
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch instructions and updates from the@nomadamas/k-skillpackage from the npm registry. - [REMOTE_CODE_EXECUTION]: Running commands like
npx -y @nomadamas/k-skill@0 instruct d2b-notice-searchinvolves downloading and executing remote code from an unverifiable source. The skill also indicates a dependency on a local moduled2b-notice-searchviarequire(). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the external D2B procurement website (
www.d2b.go.kr). This represents a potential surface for instructions hidden in procurement notices to influence agent behavior. - Ingestion points: Browser-based extraction of bid notice titles, numbers, and categories from
www.d2b.go.kr(instruction.md). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' warnings for the extracted content.
- Capability inventory: The skill utilizes browser automation (Aside Browser) and CDP session management to interact with web pages.
- Sanitization: There is no mention of sanitizing or escaping the data scraped from the procurement portal before it is processed by the agent.
Audit Metadata