seoul-bike
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves real-time bike station information from k-skill-proxy.nomadamas.org. This domain is a vendor resource belonging to the author, NomaDamas, and is used to interface with the official Seoul Open Data API.
- [PROMPT_INJECTION]: The skill processes data from an external API, creating a theoretical surface for indirect prompt injection.
- Ingestion points: Data enters via JSON responses from the proxy server in scripts/seoul_bike.py.
- Boundary markers: None are explicitly defined in the instructions.
- Capability inventory: The script's capabilities are limited to network GET requests and standard output; it does not have access to the file system or shell execution.
- Sanitization: The script extracts specific numeric and string fields from the JSON payload, which provides a layer of data sanitization.
Audit Metadata