housing-official-price
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the vendor-owned CLI tool
@nomadamas/k-skillvianpxand requires the installation of thehousing-official-pricepackage to perform its primary functions. - [COMMAND_EXECUTION]: The skill utilizes shell commands including
npx,npm install, andnode -eto fetch instructions, manage dependencies, and execute lookup logic. - [DYNAMIC_EXECUTION]: Instructions provide templates for executing JavaScript code via
node -eto interact with the property price library at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the public
realtyprice.krweb data surface, which represents an external ingestion point for untrusted data. - Ingestion points: Data is ingested through responses from
realtyprice.krcontaining apartment names, addresses, and price histories (found ininstruction.md). - Boundary markers: The instructions do not specify any boundary markers or delimiters to isolate ingested property data from the agent's instructions.
- Capability inventory: The skill environment allows for shell command execution (
node -e), package installation, and network access to public web endpoints. - Sanitization: No explicit sanitization or filtering of the external web data is described; the skill returns the raw or normalized JSON directly from the source.
Audit Metadata