emergency-room-beds
Fail
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in
SKILL.mdmandate the execution of code vianpx -y @nomadamas/k-skill@0. This command downloads and runs arbitrary code from an external package repository that is not categorized as a trusted source. - [EXTERNAL_DOWNLOADS]: The skill fetches instructions, files, and updates from an external package (
@nomadamas/k-skill) and refers to a GitHub repository (github.com/NomaDamas/k-skill) that does not belong to the list of trusted organizations. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied location information and interpolates it into search queries for external services.
- Ingestion points: User location input (landmarks, station names, coordinates) is ingested as described in
SKILL.mdandinstruction.md. - Boundary markers: None identified to separate untrusted user input from the skill's logic.
- Capability inventory: The skill performs network requests to Kakao Map and E-Gen medical endpoints and utilizes an external Node.js package (
emergency-room-beds) to handle the data. - Sanitization: There is no evidence of sanitization or validation of the location query before it is used in API requests.
Recommendations
- AI detected serious security threats
Audit Metadata