ev-subsidy-status
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxto run vendor-specific tools (ev-subsidy-status,@nomadamas/k-skill) for instruction management and data retrieval. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the
ev.or.krgovernment portal. Ingestion points: Data is fetched frominitSubsidyPaymentCheckAction.doandpsPopupLocalCarModelPrice.do. Boundary markers: Instructions require the agent to provide conservative status assessments and include specific accuracy warnings in final responses. Capability inventory: The skill profile allows for shell command execution and browser interaction. Sanitization: The skill documentation specifies a safe HTML restoration method using character map parsing, explicitly prohibiting the use ofevalorvmon remote script content.
Audit Metadata