mfds-drug-safety
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npxto fetch and execute the@nomadamas/k-skillpackage, which dynamically provides instructions and runtime helper scripts. While this involves executing code from an external registry, it is the primary documented mechanism for the skill's infrastructure. - [COMMAND_EXECUTION]: Agent instructions include executing shell commands via
npxto perform drug information lookups and conduct user interviews. - [EXTERNAL_DOWNLOADS]: The skill communicates with an external proxy server (
k-skill-proxy.nomadamas.org) to retrieve drug safety data from the Ministry of Food and Drug Safety (MFDS) OpenAPI. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from drug safety APIs. The
scripts/mfds_drug_safety.pyscript provides basic sanitization by stripping HTML tags and normalizing text. However, there are no explicit prompt boundary markers defined in the instructions for the ingested content. Mandatory evidence: 1. Ingestion point:scripts/mfds_drug_safety.pyfetches data from the proxy. 2. Boundary markers: Absent. 3. Capability inventory: Network access viaurlliband command execution vianpx. 4. Sanitization: HTML stripping and whitespace normalization.
Audit Metadata