saju-fortune
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute code from the npm registry. It uses the
@nomadamas/k-skillpackage to fetch up-to-date instructions and requires the global installation of thesaju-fortunelibrary for core calculations. These resources are owned by the skill's author. - [DYNAMIC_EXECUTION]: To perform the fortune analysis, the skill generates and executes Node.js code at runtime using shell heredocs. This code imports the local
saju-fortunepackage and processes user data. This is a standard pattern for the skill's intended utility. - [COMMAND_EXECUTION]: The skill invokes several shell commands to manage its environment, including
npm installfor dependency management andnodefor executing its logic. It also modifies theNODE_PATHenvironment variable to ensure the global packages are discoverable. - [INDIRECT_PROMPT_INJECTION]: The skill collects personal information (name, birth date, time, and location) from the user. This data is interpolated into the JavaScript execution templates. While this presents an attack surface where malformed input could potentially interfere with script execution, the risk is minimal given the specific nature of the expected inputs and the skill's local execution context.
Audit Metadata