komsa-ferry-info

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches its primary instructions and execution stubs from the author's repository using npx -y @nomadamas/k-skill@0. These resources are hosted on github.com/nomadamas, which is the vendor's own infrastructure and is documented for transparency.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute a Python helper script (scripts/komsa_ferry_info.py) and use curl to interact with the API proxy. These commands are localized to the skill's specific purpose of retrieving ferry data.
  • [DATA_EXFILTRATION]: The skill communicates with https://k-skill-proxy.nomadamas.org to fetch data. This is the official proxy managed by the skill's author ('nomadamas') and is a legitimate vendor resource used to safely inject API keys without exposing them to the agent or user.
  • [SAFE]: The skill contains explicit safety rules in SKILL.md that prevent the agent from performing unauthorized payments, messaging, or identity-proofing tasks. It also follows best practices for secret management by instructing users never to store API keys in chat or local files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 10:48 AM
Security Audit — agent-trust-hub — komsa-ferry-info