consumer-price-safety-search
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@nomadamas/k-skillpackage from the npm registry usingnpx. This is a vendor-owned utility used to manage instructions and helper files for the skill. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto execute the downloaded@nomadamas/k-skillCLI tool at runtime to provide instructions and file listings to the agent. - [COMMAND_EXECUTION]: The skill instructs the user or agent to run shell commands (via
npx) to initialize its operational instructions. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external API sources, which represents a potential attack surface if the remote content contains malicious instructions.
- Ingestion points: External API data retrieved from
data.go.kr(Open API) andconsumer.go.kr. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined in the draft instructions to separate API content from agent instructions.
- Capability inventory: The skill possesses shell execution capabilities (via
npx) and environment variable access for credential management. - Sanitization: No explicit sanitization or validation logic for the external API payloads is documented in the current scaffold.
Audit Metadata