korean-heritage-search
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@nomadamas/k-skillCLI tool from the NPM registry. This tool is utilized for fetching instructions, managing files, and performing updates related to the skill. - [COMMAND_EXECUTION]: The skill functions by executing a bundled Python script (
scripts/korean_heritage_search.py) which processes commands for heritage searches and detailed record retrieval. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external XML APIs provided by the Korea Heritage Service.
- Ingestion points: Data is retrieved from the
khs.go.krendpoints for heritage lists, details, and events. - Boundary markers: The output passed to the agent does not include specific boundary delimiters or safety warnings regarding the ingested data.
- Capability inventory: The skill has network access to the heritage API and the ability to print resulting data to the console for agent consumption.
- Sanitization: The Python script implements a
_clean_textfunction that uses regular expressions to strip HTML tags and unescape entities, reducing the risk of accidental instruction execution from the API response.
Audit Metadata