seoul-weather-risk
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the use of
npx -y @nomadamas/k-skill@0to download a CLI utility from the NPM registry. The authoring organization '@nomadamas' is not included in the trusted vendors list.\n- [REMOTE_CODE_EXECUTION]: By directing the agent to runnpx, the skill facilitates the execution of remote code from the public NPM registry without integrity verification of the specific version used.\n- [COMMAND_EXECUTION]: The workflow involves executing local shell commands (npx,python3) orchestrated by the externalk-skilltool to process weather data.\n- [DATA_EXFILTRATION]: The skill makes network requests tohttps://k-skill-proxy.nomadamas.orgto fetch weather information. This domain is not among the whitelisted services, creating an external dependency for data retrieval.
Audit Metadata