fsc-corporate-info
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions utilize
npxto download and execute the@nomadamas/k-skillpackage from the NPM registry to retrieve stubs and latest instructions. As this package is owned by the skill vendor, this is considered standard operational behavior. - [COMMAND_EXECUTION]: The documentation guides users to execute
npxcommands for skill updates and instruction fetching. These commands interact with the vendor's official CLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from an external API, creating a surface for potential indirect prompt injection if the source data is compromised.
- Ingestion points: The
query_corp_outlinefunction inscripts/fsc_corporate_info.pyconsumes JSON responses from thek-skill-proxy.nomadamas.orgendpoint. - Boundary markers: No specific delimiters or "ignore instructions" warnings are present in the processing logic.
- Capability inventory: The skill is capable of network GET requests and writing to stdout for agent consumption.
- Sanitization: The script validates business registration numbers using regular expressions and strictly parses the API response as JSON, providing a layer of protection against malformed or unstructured data injections.
Audit Metadata