housing-subscription-reference
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
@nomadamas/k-skillpackage from the NPM registry usingnpx. This is a vendor-owned resource used for skill management and instruction delivery. - [REMOTE_CODE_EXECUTION]: The skill executes instructions and updates via the
@nomadamas/k-skillCLI tool at runtime. This package is maintained by the skill author and is used to ensure the agent uses the most current instruction set. - [COMMAND_EXECUTION]: Uses
npxcommands to read bundled reference files and perform administrative tasks such as updating the skill environment. The commands interact with local CSV files using hardcoded paths. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes data from local files including
housing_subscription_score.csvandprivate_housing_deposit.csv. This ingestion of external data represents a potential attack surface if the data were to be tampered with. The skill uses specific keys and structured workflows to help mitigate accidental obedience to embedded instructions.
Audit Metadata