naver-ad-performance
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxcommands to invoke the@nomadamas/k-skillCLI for management tasks, instruction retrieval, and script execution. - Evidence found in
SKILL.mdandinstruction.mdusing patterns likenpx -y @nomadamas/k-skill@0 exec .... - [EXTERNAL_DOWNLOADS]: The skill fetches instructions and manages its environment by downloading assets from the
@nomadamas/k-skillpackage on npm. - Referenced in
SKILL.md:npx -y @nomadamas/k-skill@0 update. - [DATA_EXFILTRATION]: The skill accesses API credentials (
NAVER_AD_API_KEY,NAVER_AD_SECRET_KEY,NAVER_AD_CUSTOMER_ID) from environment variables and transmits them to the official Naver API domain for authentication. - Evidence in
scripts/naver_ad_performance.pywhere credentials are used to sign requests sent toapi.searchad.naver.com. - This is consistent with the skill's primary purpose of interfacing with the Naver Ads API.
Audit Metadata