naver-ad-performance
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @nomadamas/k-skill@0to retrieve instructions and execute the underlying Python scripts. These resources are hosted within the '@nomadamas' namespace, which is the official package name for the skill's author, representing an expected vendor-owned dependency. - [COMMAND_EXECUTION]: The operational workflow requires the execution of shell commands through the
npxutility. These commands are used to invoke thenaver_ad_performance.pyscript for diagnostic ('doctor'), structural ('campaigns', 'adgroups'), and performance ('stats') queries. - [CREDENTIALS_SAFE]: The skill requires three API credentials (
NAVER_AD_API_KEY,NAVER_AD_SECRET_KEY, andNAVER_AD_CUSTOMER_ID). The implementation correctly resolves these from the environment or a secure vault, avoiding hardcoded secrets or insecure logging of sensitive keys. - [DATA_EXFILTRATION]: Network activity is confined to the official Naver Search Ad API domain (
api.searchad.naver.com). The script only performs GET requests to retrieve marketing data and does not attempt to access or transmit sensitive local files such as SSH keys or AWS configuration.
Audit Metadata