data-public
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages API authentication keys (DATA_GO_KR_API_KEY, KOSIS_API_KEY) by instructing the agent to store them in a local configuration file at
${CLAUDE_PLUGIN_DATA}/moai-credentials.env. This is a standard and safe practice for secret management in this context. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill performs network operations to retrieve statistical data from well-known and trusted South Korean government domains, specifically apis.data.go.kr and kosis.kr. These interactions are consistent with the skill's stated purpose and do not involve executing remote code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs, which represents a standard data ingestion surface.
- Ingestion points: External statistical data is fetched from apis.data.go.kr and kosis.kr via the WebFetch tool.
- Boundary markers: No explicit instructions are provided to the agent to treat API responses with specific delimiters or warnings, though the data is structured.
- Capability inventory: The skill parses statistical data for display in markdown tables or for use in visualization tools like moai-analyst:data-visualizer.
- Sanitization: The skill relies on parsing structured data (JSON/XML/SDMX) from reputable government sources, which minimizes the risk of processing malicious instructions.
Audit Metadata