government-support-survey

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries a proxy service to survey government support notices from public portals (K-Startup, Bizinfo, NIPA, KOCCA, SMTECH), which aggregate public listings rather than allowing unauthenticated outsiders to post monitored free text directly into a consumed queue.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill executes npx to install and run remote code from @nomadamas/k-skill, an unofficial third-party registry package, during initialization and runtime instructions.