k-schoollunch-menu

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to run npx -y @nomadamas/k-skill@0 instruct k-schoollunch-menu. This command downloads and executes code from a remote package repository to provide the agent with its primary operational instructions at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from an external proxy service at k-skill-proxy.nomadamas.org and instructions from a GitHub repository. These connections are necessary for the skill to retrieve school meal information from the NEIS portal.
  • [COMMAND_EXECUTION]: The skill uses curl to perform network requests and npx to execute the developer's CLI tool. These commands are used to interact with external APIs and manage skill updates.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from the NEIS (National Education Information System) portal through a proxy.
  • Ingestion points: Data enters the context via the school-search and school-meal API responses in instruction.md.
  • Boundary markers: None identified for the API data processing.
  • Capability inventory: The skill uses curl for API calls and npx for tool execution as defined in instruction.md and SKILL.md.
  • Sanitization: The instructions suggest converting <br/> tags to newlines but do not specify comprehensive sanitization for the external content before it is presented to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 02:41 PM