d2b-notice-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch the@nomadamas/k-skillpackage from the NPM registry to retrieve instructions and perform updates. - [REMOTE_CODE_EXECUTION]: Executes code from the vendor-owned
@nomadamas/k-skillpackage vianpxto provide dynamic instructions and maintain the skill's state. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the external D2B procurement portal (
www.d2b.go.kr). - Ingestion points: Extracts bid titles, notice numbers, and organization names from search result pages in
instruction.md. - Boundary markers: Not present; the skill treats extracted text as raw informational data.
- Capability inventory: Browser automation capabilities including navigation, form filling, and DOM interaction.
- Sanitization: No specific sanitization of external procurement content is implemented before it is returned to the agent context.
Audit Metadata