seoul-weather-risk
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches primary instructions and utility files dynamically using the author's official CLI package (@nomadamas/k-skill) via npx as documented in SKILL.md.
- [REMOTE_CODE_EXECUTION]: Executes shell commands and fetches remote instructions through the author's CLI tool. These operations are within the scope of the vendor's own infrastructure.
- [CREDENTIALS_UNSAFE]: The Python client supports reading a MARKETPLACE_API_KEY from a local .env file or environment variables when local-direct mode is enabled. The script implements safe practices by restricting access to specific variable names and ensuring keys are not printed to logs.
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from an external weather API. Ingestion points: scripts/seoul_weather_risk.py. Boundary markers: Absent in response data. Capability inventory: Network requests and local file reading. Sanitization: Uses standard JSON parsing before displaying data to the agent.
Audit Metadata