biz-health-check
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/biz_health_check.pydynamically loads and executes Python modules from sibling directories usingimportlib.util. The module paths are computed relative to the script's location (_REPO_ROOT / skill_dir / "scripts" / filename). This facilitates a modular architecture where the composite skill reuses logic from independent sub-skills. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a data aggregator for business-related information, creating a surface for potential indirect prompt injection through processed external content.
- Ingestion points: Business registration numbers (
b_no), company names (name), and regional parameters (region) provided to therunfunction inscripts/biz_health_check.py. - Boundary markers: The skill output includes a clear
disclaimerfield stating that the report is a collection of facts without interpretation, intended for the user's evaluation. - Capability inventory: The script performs dynamic module loading and passes configuration (like
base_url) to modules that perform network-based queries. - Sanitization: The
_normalize_b_nofunction uses regular expressions (re.subandre.fullmatch) to strictly validate that the registration number is a 10-digit numeric string. - [EXTERNAL_DOWNLOADS]: The skill uses a vendor-owned CLI tool,
@nomadamas/k-skill, which is fetched and executed vianpxas described inSKILL.mdandinstruction.md. This tool is used to synchronize instructions and manage the skill's execution environment.
Audit Metadata