religious-facility-search
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill relies on the
@nomadamas/k-skillpackage from the NPM registry to display instructions and execute helper scripts. This is a vendor-provided tool designed for skill management. - [COMMAND_EXECUTION]: The instructions direct the agent to execute the bundled Python script
scripts/religious_facility_search.pyto perform religious facility lookups. This execution is standard for the skill's functionality. - [DATA_EXFILTRATION]: The Python script sends user-provided location keywords and facility types to the vendor-operated proxy at
https://k-skill-proxy.nomadamas.org. This proxy facilitates authentication with the Kakao Local API. No sensitive local data is transmitted. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the Kakao Local API, such as facility names, addresses, and telephone numbers. This represents an ingestion point for untrusted data from an external service.
- Ingestion points: API responses retrieved in
scripts/religious_facility_search.pyviafetch_json. - Boundary markers: None implemented for the API-sourced content displayed to the user.
- Capability inventory: The skill is limited to performing network requests to the vendor proxy and printing results to the terminal.
- Sanitization: The script uses standard Python string and JSON formatting to present data.
Audit Metadata