bccard-eatpl-search
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches its primary instructions and executes helper scripts using the
@nomadamas/k-skillpackage from the NPM registry. - [COMMAND_EXECUTION]: The instructions direct the agent to run
curlto query the vendor's proxy endpoint andnpxto run CLI tools and scripts associated with the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which could contain malicious instructions aimed at the agent.
- Ingestion points: Data is retrieved from
https://k-skill-proxy.nomadamas.organdhttps://m.map.kakao.com/actions/searchView(via HTML scraping). - Boundary markers: Absent; the workflow does not define specific markers or instructions to isolate the processed external data from the agent's internal control flow.
- Capability inventory: The skill possesses the ability to execute shell commands (
npx,curl) and perform network operations. - Sanitization: No explicit sanitization or validation of the retrieved API or HTML content is documented before it is presented to the user in the results table.
Audit Metadata