railway-timetable
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches railway timetable indices (JSON) and schedule files (XLSX) from the official Korail website (www.korail.com).
- [REMOTE_CODE_EXECUTION]: Instructs the agent to download and execute code from the NPM registry using 'npx -y @nomadamas/k-skill@0'. This package belongs to the skill's author and is used to provide updated instructions and execute the backend scripts.
- [COMMAND_EXECUTION]: Utilizes shell commands via npx to interact with the vendor-provided CLI tool and execute Python scripts using 'uv run'.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill downloads and parses XLSX files from the Korail website board in 'scripts/ktx_backend.py'.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present when processing the external data.
- Capability inventory: The skill has the capability to perform network requests and execute subprocess commands via npx.
- Sanitization: Implements station name normalization and regex-based validation for train numbers, departure/arrival times, and dates in 'scripts/ktx_timetable.py' and 'scripts/ktx_backend.py'.
Audit Metadata