korean-heritage-search
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes HTTP requests to the official Korea Heritage Service domain (
www.khs.go.kr) to retrieve heritage records and event information. These network operations are limited to the official API endpoints required for the skill's stated purpose. - [COMMAND_EXECUTION]: The provided Python script processes data and handles API communication but does not execute arbitrary shell commands or spawn untrusted sub-processes.
- [DATA_EXFILTRATION]: No unauthorized data transmission was detected. The script does not access sensitive local files or environment variables; network activity is strictly directed to the official government API.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API, which is a potential surface for indirect prompt injection. However, the script implements sanitization by stripping HTML tags and unescaping characters from the API responses before returning them to the agent. Given the official nature of the data source and the implemented cleaning logic, the risk is minimal.
Audit Metadata