g2b-order-plan-search
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions utilize
npxto download and run the@nomadamas/k-skillpackage, which is a CLI tool maintained by the author. - [COMMAND_EXECUTION]: The skill requires executing shell commands via
npxand a local Python script to perform searches. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external API, creating a surface where untrusted content could influence the agent's behavior.
- Ingestion points: The
scripts/g2b_order_plan.pyscript fetches data from thek-skill-proxy.nomadamas.orgendpoint viaurllib.request.urlopen. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the skill's workflow to isolate external content.
- Capability inventory: The script
scripts/g2b_order_plan.pyperforms network GET requests to a proxy server and prints the resulting JSON to stdout. No file-writing or code execution capabilities are present in the script. - Sanitization: External API content is printed directly to the agent's context as raw JSON without specialized sanitization or validation.
Audit Metadata