danawa-price-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill utilizes the
npxpackage runner to download and execute the@nomadamas/k-skillpackage from the NPM registry. This package is used to provide instructions and manage the execution of the skill's helper scripts. As a vendor-owned resource, this is considered a standard part of the skill's operational model. - [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/danawa_search.py) to perform search and price comparison tasks. The script uses standard libraries to fetch public data from Danawa and does not perform any sensitive system modifications. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external web pages on the Danawa platform. The Python helper script includes text cleaning functions to normalize this content. While third-party product data could theoretically contain malicious text, the risk is low as the skill's capabilities are limited to information retrieval and it explicitly prohibits automated payments or credential handling.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
beautifulsoup4Python package and the@nomadamas/k-skillNode.js package to function properly.
Audit Metadata