joseon-sillok-search
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions require the use of the
@nomadamas/k-skillpackage, which is fetched from the NPM registry during execution. - [REMOTE_CODE_EXECUTION]: The workflow involves using
npxto execute the@nomadamas/k-skilltool for retrieving instructions and running the provided search script. This pattern results in the dynamic download and execution of external code at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from an external historical database (
sillok.history.go.kr), which represents a surface for indirect prompt injection if the source website's content were manipulated. - Ingestion points: The
scripts/sillok_search.pyscript fetches and parses HTML search results and article details from the external site. - Boundary markers: The skill does not provide clear delimiters or instructions to the agent to differentiate between the agent's instructions and the untrusted data retrieved from the records.
- Capability inventory: The skill possesses network access capabilities and the instructions suggest a workflow involving shell command execution via
npx. - Sanitization: The script performs text cleaning for display purposes (HTML unescaping and regex-based tag removal) but does not include safety-specific sanitization to prevent the agent from acting on instructions potentially embedded within the records.
Audit Metadata