seoul-weather-risk

Warn

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the use of npx -y @nomadamas/k-skill@0 to download a CLI utility from the NPM registry. The authoring organization '@nomadamas' is not included in the trusted vendors list.\n- [REMOTE_CODE_EXECUTION]: By directing the agent to run npx, the skill facilitates the execution of remote code from the public NPM registry without integrity verification of the specific version used.\n- [COMMAND_EXECUTION]: The workflow involves executing local shell commands (npx, python3) orchestrated by the external k-skill tool to process weather data.\n- [DATA_EXFILTRATION]: The skill makes network requests to https://k-skill-proxy.nomadamas.org to fetch weather information. This domain is not among the whitelisted services, creating an external dependency for data retrieval.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 1, 2026, 02:41 PM