nhis-care-checkup-search
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in
SKILL.mdrecommend runningnpx -y @nomadamas/k-skill@0, which downloads and executes code from the npm registry. This is used to provide up-to-date instructions from the vendor. - [DATA_EXFILTRATION]: The skill sends search queries to
k-skill-proxy.nomadamas.org. While this involves sending user-provided search terms to an external domain, it is a vendor-owned resource necessary for the skill's functionality and protects API keys. - [INDIRECT_PROMPT_INJECTION]: The skill processes facility data for summarization. 1. Ingestion points: XML responses from the
k-skill-proxyendpoint. 2. Boundary markers: None present. 3. Capability inventory: Limited to network requests viacurl. 4. Sanitization: None explicitly defined; the skill performs field-based summarization of public records.
Audit Metadata