delivery-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
@nomadamas/k-skillNode.js package, which is a vendor-owned resource, to fetch updated instructions and manage the skill environment vianpxcommands. - [COMMAND_EXECUTION]: The instruction set includes bash scripts that execute
curlfor network requests andpython3for data processing. These scripts follow safe practices by using temporary files for intermediate storage and cleaning them up after execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external tracking pages at
cjlogistics.comandepost.go.kr. - Ingestion points: Data is fetched via
curlinto local variables or temporary files ininstruction.md. - Boundary markers: No specific delimiters are used, but data is treated as a string for parsing.
- Capability inventory: The skill can execute network requests (
curl) and local Python scripts. - Sanitization: High. The skill uses strict JSON path navigation and regular expressions to extract only specific logistics fields (status, timestamp, location), effectively sanitizing the input before presenting it to the agent/user.
Audit Metadata