naming-house
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands to install global Node.js packages (
npm install -g naming-house) and to execute JavaScript code blocks by piping them into thenodeCLI. This is a functional requirement for the skill to perform complex Korean name analysis. - [EXTERNAL_DOWNLOADS]: The skill fetches the
naming-houseand@nomadamas/k-skillpackages from the public npm registry. These are vendor-owned resources that facilitate the core functionality of name scoring and instruction retrieval. - [DATA_EXPOSURE]: To provide accurate Saju (Four Pillars of Destiny) analysis, the skill requests sensitive user inputs including full birth dates, times, and birth cities. The instruction manual explicitly specifies that this data is used only for the current session's analysis and is not stored or shared, which aligns with security best practices for handling Personal Identifiable Information (PII).
- [DYNAMIC_EXECUTION]: The workflow involves generating and running dynamic JavaScript snippets to call the internal methods of the naming library. While this involves runtime execution, it is scoped to the specific functions of the installed naming package.
Audit Metadata