komsa-ferry-info
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches its primary instructions and execution stubs from the author's repository using
npx -y @nomadamas/k-skill@0. These resources are hosted ongithub.com/nomadamas, which is the vendor's own infrastructure and is documented for transparency. - [COMMAND_EXECUTION]: The instructions direct the agent to execute a Python helper script (
scripts/komsa_ferry_info.py) and usecurlto interact with the API proxy. These commands are localized to the skill's specific purpose of retrieving ferry data. - [DATA_EXFILTRATION]: The skill communicates with
https://k-skill-proxy.nomadamas.orgto fetch data. This is the official proxy managed by the skill's author ('nomadamas') and is a legitimate vendor resource used to safely inject API keys without exposing them to the agent or user. - [SAFE]: The skill contains explicit safety rules in
SKILL.mdthat prevent the agent from performing unauthorized payments, messaging, or identity-proofing tasks. It also follows best practices for secret management by instructing users never to store API keys in chat or local files.
Audit Metadata