fsc-corporate-info

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions utilize npx to download and execute the @nomadamas/k-skill package from the NPM registry to retrieve stubs and latest instructions. As this package is owned by the skill vendor, this is considered standard operational behavior.
  • [COMMAND_EXECUTION]: The documentation guides users to execute npx commands for skill updates and instruction fetching. These commands interact with the vendor's official CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from an external API, creating a surface for potential indirect prompt injection if the source data is compromised.
  • Ingestion points: The query_corp_outline function in scripts/fsc_corporate_info.py consumes JSON responses from the k-skill-proxy.nomadamas.org endpoint.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are present in the processing logic.
  • Capability inventory: The skill is capable of network GET requests and writing to stdout for agent consumption.
  • Sanitization: The script validates business registration numbers using regular expressions and strictly parses the API response as JSON, providing a layer of protection against malformed or unstructured data injections.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:50 AM