korean-character-count
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's instructions in
SKILL.mdandinstruction.mddirect the agent to usenpxto fetch the@nomadamas/k-skillpackage from the npm registry. This is used to retrieve instructions and execute the counting logic. - [REMOTE_CODE_EXECUTION]: The workflow leverages
npx -y @nomadamas/k-skill@0to execute remote code from the npm registry. This is utilized to run the localscripts/korean_character_count.jsfile within the vendor's CLI environment. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands (e.g.,
npx,cat) to process text inputs and generate character count reports. This is a core component of the skill's operational design. - [DATA_EXFILTRATION]: The helper script
scripts/korean_character_count.jsincludes the capability to read local files viafs.readFileSyncwhen the--fileflag is used. While this provides the agent with the ability to access filesystem data, the script is designed to output character counts and metadata rather than the raw file contents, and this access is part of the skill's primary purpose for counting text in documents.
Audit Metadata