government-support-survey
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@nomadamas/k-skillpackage from the npm registry usingnpxto obtain instructions and execute the survey helper scripts. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves data from external government portals (K-Startup, Bizinfo, NIPA, KOCCA, SMTECH) via the
k-skill-proxy.nomadamas.orgendpoint. - Boundary markers:
SKILL.mdcontains "Hard rules" that explicitly forbid the agent from bypassing safety filters, electronic signature boundaries, or performing financial transactions without approval. - Capability inventory: The skill executes a Python script (
scripts/run_survey.py) which performs network requests and outputs JSON data to be processed by the agent. - Sanitization: The instructions direct the agent to verify eligibility criteria against official documentation and attachments, providing a manual check against potentially misleading metadata.
- [COMMAND_EXECUTION]: The skill uses shell commands via
npxto manage instruction display and the execution of the survey script.
Audit Metadata