ev-subsidy-status

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries government EV subsidy status tables from an official public web portal (ev.or.kr) and parses municipal notes and counts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs execution of a third-party npm package (@nomadamas/k-skill) from npm and references a GitHub repository containing skill instruction code, introducing an external runtime dependency of unspecified/community provenance.