ohou-today-deal
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to use
npx -y @nomadamas/k-skill@0to fetch instructions and execute scripts. This package is a vendor-owned resource managed by the skill's author (nomadamas). - [COMMAND_EXECUTION]: The skill functionality is exposed through shell commands using
npx, which executes remote packages and local Python scripts to interact with the target commerce site. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a public web page (
ohou.se). While it lacks explicit sanitization or boundary markers for the extracted product names and brands, the risk is mitigated by the script's limited capability to only output structured JSON without executing any part of the retrieved content.
Audit Metadata