donation-place-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses the
npxutility to retrieve and run instructions from the@nomadamas/k-skillpackage, which is maintained by the skill author. - [DYNAMIC_EXECUTION]: The skill generates a JavaScript snippet and executes it via
nodeat runtime to call thedonation-place-searchlibrary for filtering donation opportunities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests 'location' and 'category' parameters provided by the user to perform its search.
- Ingestion points: User-supplied input strings for location and category in
instruction.md. - Boundary markers: None explicitly specified in the logic.
- Capability inventory: Subprocess execution of Node.js code.
- Sanitization: No specific input validation or escaping mechanisms are described before processing the user inputs.
Audit Metadata