real-estate-search
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@nomadamas/k-skillCLI tool from the NPM registry. This package is maintained by the skill's author. - [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/nationwide_daily_report.py) to fetch and process property data from official South Korean government domains. - [INDIRECT_PROMPT_INJECTION]: The skill ingests property transaction data from external APIs and CSV files, creating a potential attack surface for indirect prompt injection if upstream sources were compromised.
- Ingestion points: Data ingestion from
k-skill-proxy.nomadamas.organdrt.molit.go.kr. - Boundary markers: None specifically defined.
- Capability inventory: Shell execution (
npx), file access, and network operations (urllib.request). - Sanitization: The Python script uses standard libraries and specific type validation to parse data.
Audit Metadata