ev-charger-nearby
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from
k-skill-proxy.nomadamas.org(vendor infrastructure) orapis.data.go.kr(official South Korean government API portal). These are legitimate, purpose-specific endpoints for retrieving EV charging station data. - [COMMAND_EXECUTION]: The skill uses
urllibfor network requests andargparsefor CLI management. It does not spawn subprocesses or execute system commands. Dynamic module loading in the test suite (importlib.util) is restricted to the skill's own local script for unit testing purposes. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by resolving API keys from environment variables or a local
.envfile at a standard configuration path (~/.config/k-skill/secrets.env). It explicitly redacts these keys during--dry-runoperations to prevent accidental exposure. - [DATA_EXFILTRATION]: No sensitive local data is accessed. The skill only transmits user-provided search parameters (location, station IDs) to the designated API endpoints to fulfill the user's request.
- [PROMPT_INJECTION]: The skill instructions (SKILL.md) are strictly functional and do not contain patterns designed to override agent behavior or bypass safety guardrails.
Audit Metadata