komsa-ferry-info
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@nomadamas/k-skillpackage. This package provides dynamic instructions and executes the bundled Python helper script. As this resource is owned by the skill's author, it represents part of the intended functionality. - [COMMAND_EXECUTION]: Instructions direct the user to execute shell commands, including
npxand a Python script (scripts/komsa_ferry_info.py), to query ferry schedules and vessel information. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external KOMSA MTIS API (via a proxy), which introduces a surface for indirect prompt injection if the upstream data source is compromised.
- Ingestion points: External data is ingested from
k-skill-proxy.nomadamas.orgwithin thequeryfunction inscripts/komsa_ferry_info.py. - Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the external data before it is presented to the agent.
- Capability inventory: The skill is limited to performing network GET requests to the specified proxy and displaying the resulting JSON data.
- Sanitization: The script performs standard JSON parsing but does not include explicit sanitization or filtering of the textual content returned by the API.
Audit Metadata