housing-official-price
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
housing-official-priceNode.js package. This is a vendor-specific package (by NomaDamas) designed to interact with the undocumented web surface of therealtyprice.krgovernment site. - [COMMAND_EXECUTION]: Instructions guide the agent to generate and execute shell commands (
node -e) to interact with the housing price package. These command templates interpolate user-supplied strings, such as apartment complex names, without explicit guidance on escaping or sanitization, creating a potential vector for command injection. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a public, undocumented external source (
realtyprice.kr). - Ingestion points: Data is retrieved from the
realtyprice.krweb surface through thehousing-official-pricepackage. - Boundary markers: None are present; the skill treats the external data as trusted structured content.
- Capability inventory: The agent can execute shell commands (
node -e) to perform lookups. - Sanitization: The skill specifies validation for 19-digit parcel identifiers (PNU) but does not include sanitization logic for other user-provided strings used in command construction.
Audit Metadata