highway-traffic-status
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions recommend using
npxto download and run@nomadamas/k-skill, a package maintained by the skill's author, to manage instructions and script execution. - [COMMAND_EXECUTION]: Execution of the helper script
scripts/highway_traffic.pyis performed through shell commands to retrieve and process traffic data. - [PROMPT_INJECTION]: The skill processes data from external APIs (
data.ex.co.krandits.go.kr), which presents a surface for indirect prompt injection. - Ingestion points: Real-time traffic and CCTV metadata are retrieved via HTTP GET requests in
scripts/highway_traffic.py. - Boundary markers: The skill outputs structured JSON or summary text; no explicit delimiters or instructions to ignore embedded content are used in the script's output.
- Capability inventory: The helper script has the ability to make network requests and read from the
~/.config/k-skill/directory. - Sanitization: The script parses responses using standard JSON and XML libraries, extracting only expected fields.
- [SAFE]: No malicious patterns such as obfuscation, persistence mechanisms, or unauthorized privilege escalation were identified. Access to the configuration file is restricted to a skill-specific directory.
Audit Metadata