daiso-product-search
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
daiso-product-searchpackage from the npm registry to perform its core functions. - [REMOTE_CODE_EXECUTION]: The skill instructions in
SKILL.mddirect the agent to execute severalnpxcommands (e.g.,npx -y @nomadamas/k-skill@0 instruct daiso-product-search). This pattern downloads and executes code from a remote source to retrieve the skill's primary instructions and legal documentation. - [DYNAMIC_EXECUTION]: The skill relies on runtime execution of shell commands via
npxto maintain updated instructions and verify file contents, rather than providing all logic statically within the skill files. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from
daisomall.co.krAPIs (product names, descriptions, and stock status). - Ingestion points: API responses from
daisomall.co.kr(e.g.,SearchGoods,selStrPkupStck). - Boundary markers: None explicitly defined in the instructions for the agent to use when parsing or presenting external content.
- Capability inventory: The skill has the capability to perform network requests to retail APIs and execute shell commands via
npx. - Sanitization: No specific sanitization or filtering logic is described for handling the content retrieved from the external retail surfaces.
Audit Metadata