korean-law-search

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves its primary instructions and helper files by downloading the @nomadamas/k-skill package via npx. These resources are hosted on the NPM registry and maintained by the skill's author.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute npx commands to initialize its environment and list bundled files. This involves running executable code fetched from an external repository during the setup phase.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from the Korean National Law Information Center via a proxy server (k-skill-proxy.nomadamas.org). This introduces a surface where external data (legal text) is interpolated into the agent's context. The skill mitigates this by instructing the agent to provide summaries and direct source links rather than definitive legal advice, and to avoid creating non-existent content.
  • Ingestion points: External data is ingested through GET requests to /v1/korean-law/search and /v1/korean-law/detail in instruction.md.
  • Boundary markers: The instructions specify that results should be summarized and sources provided, acting as logical boundaries for the output.
  • Capability inventory: The skill uses curl for network operations and npx for command execution.
  • Sanitization: The skill relies on specific response policies to ensure the agent does not interpret the data as binding legal counsel.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:30 AM
Security Audit — agent-trust-hub — korean-law-search