library-book-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
curlcommand to interact withk-skill-proxy.nomadamas.org. This is a vendor-owned domain used for its intended purpose of searching library data.- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to runnpxcommands to fetch instructions from the@nomadamas/k-skillpackage. This is a vendor-managed resource on the NPM registry used for skill configuration.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Data4Library API via a proxy, which could potentially contain malicious content aimed at the LLM. - Ingestion points: Search results, book details, and library listings fetched via
curlininstruction.md. - Boundary markers: None explicitly mentioned in the instructions to delimit external data from agent instructions.
- Capability inventory: Network access via
curlfor HTTP GET requests. - Sanitization: No explicit sanitization or filtering of book metadata is described in the workflow.
Audit Metadata