real-estate-search
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
npxutility to execute a custom CLI tool,@nomadamas/k-skill, which manages instruction delivery, skill updates, and the execution of thenationwide_daily_report.pyscript. - [EXTERNAL_DOWNLOADS]: The skill retrieves its primary instructions and utility scripts from the npm registry and the
@nomadamasorganization's public GitHub repository. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from government sources and proxy servers, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: External data enters the agent's context from
k-skill-proxy.nomadamas.organd via thenationwide_daily_report.pyscript which fetches CSV data fromrt.molit.go.kr. - Boundary markers: The instructions provide clear directives on response formatting and source attribution to maintain data integrity.
- Capability inventory: The skill performs network operations to retrieve transaction data and executes a specific Python script to aggregate nationwide reports.
- Sanitization: The reporting script implements defensive measures such as strict response size limits (JSON and CSV) and uses standard, non-dynamic parsing libraries for processing external content.
Audit Metadata