k-schoollunch-menu
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to run
npx -y @nomadamas/k-skill@0 instruct k-schoollunch-menu. This command downloads and executes code from a remote package repository to provide the agent with its primary operational instructions at runtime. - [EXTERNAL_DOWNLOADS]: The skill fetches data from an external proxy service at
k-skill-proxy.nomadamas.organd instructions from a GitHub repository. These connections are necessary for the skill to retrieve school meal information from the NEIS portal. - [COMMAND_EXECUTION]: The skill uses
curlto perform network requests andnpxto execute the developer's CLI tool. These commands are used to interact with external APIs and manage skill updates. - [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from the NEIS (National Education Information System) portal through a proxy.
- Ingestion points: Data enters the context via the
school-searchandschool-mealAPI responses ininstruction.md. - Boundary markers: None identified for the API data processing.
- Capability inventory: The skill uses
curlfor API calls andnpxfor tool execution as defined ininstruction.mdandSKILL.md. - Sanitization: The instructions suggest converting
<br/>tags to newlines but do not specify comprehensive sanitization for the external content before it is presented to the user.
Audit Metadata