housing-official-price

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the vendor-owned CLI tool @nomadamas/k-skill via npx and requires the installation of the housing-official-price package to perform its primary functions.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands including npx, npm install, and node -e to fetch instructions, manage dependencies, and execute lookup logic.
  • [DYNAMIC_EXECUTION]: Instructions provide templates for executing JavaScript code via node -e to interact with the property price library at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the public realtyprice.kr web data surface, which represents an external ingestion point for untrusted data.
  • Ingestion points: Data is ingested through responses from realtyprice.kr containing apartment names, addresses, and price histories (found in instruction.md).
  • Boundary markers: The instructions do not specify any boundary markers or delimiters to isolate ingested property data from the agent's instructions.
  • Capability inventory: The skill environment allows for shell command execution (node -e), package installation, and network access to public web endpoints.
  • Sanitization: No explicit sanitization or filtering of the external web data is described; the skill returns the raw or normalized JSON directly from the source.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:50 AM
Security Audit — agent-trust-hub — housing-official-price