zipcode-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries an official postal search service (epost.kr) with user-supplied search keywords, which is an active search/fetch of external data rather than a monitored feed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill queries the official ePost search page (https://www.epost.kr) and fetches instructions via an NPM package (@nomadamas/k-skill), which is an unverified third-party community registry package representing a medium-tier operational dependency.