store-longevity-radar

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches retail store datasets from the official South Korean Public Data Portal (data.go.kr) and a fallback mirror hosted on Cloudflare R2 (r2.dev). The download script (store_longevity_download.py) implements security best practices including SHA-256 integrity verification and ZIP consistency checks before processing files.\n- [COMMAND_EXECUTION]: The instructions guide the agent to use npx shell commands to retrieve current instructions and manage skill updates from the @nomadamas/k-skill package on the NPM registry.\n- [REMOTE_CODE_EXECUTION]: The skill relies on the @nomadamas/k-skill CLI package for its instruction delivery and maintenance workflow, which involves executing code from the NPM registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes store names, addresses, and industry codes from external CSV files via the extract_current and load_old functions. While this creates a potential surface for indirect prompt injection via retail store names, the risk is minimized by structured parsing using the csv module and standard library processing rather than direct prompt interpolation, and the skill's capabilities are limited to file writes and authenticated network reads.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 02:41 PM