store-longevity-radar
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches retail store datasets from the official South Korean Public Data Portal (
data.go.kr) and a fallback mirror hosted on Cloudflare R2 (r2.dev). The download script (store_longevity_download.py) implements security best practices including SHA-256 integrity verification and ZIP consistency checks before processing files.\n- [COMMAND_EXECUTION]: The instructions guide the agent to usenpxshell commands to retrieve current instructions and manage skill updates from the@nomadamas/k-skillpackage on the NPM registry.\n- [REMOTE_CODE_EXECUTION]: The skill relies on the@nomadamas/k-skillCLI package for its instruction delivery and maintenance workflow, which involves executing code from the NPM registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes store names, addresses, and industry codes from external CSV files via theextract_currentandload_oldfunctions. While this creates a potential surface for indirect prompt injection via retail store names, the risk is minimized by structured parsing using thecsvmodule and standard library processing rather than direct prompt interpolation, and the skill's capabilities are limited to file writes and authenticated network reads.
Audit Metadata