korean-marathon-schedule
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
npxcommand to fetch the@nomadamas/k-skillpackage from the official Node.js package registry. This tool is provided by the skill's author to display instructions and manage skill-related files.- [COMMAND_EXECUTION]: The skill performs its primary operations usingnodeandnpxcommands to execute search scripts and retrieve event data. These commands are standard for the skill's documented functionality.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external marathon websites, which creates an attack surface for untrusted content. - Ingestion points: Public race list and detail pages from
gorunning.krandtriathlon.or.kras specified ininstruction.md. - Boundary markers: The instructions provide a specific output format and mandate conservative summarization of event details.
- Capability inventory: The skill uses network requests for web scraping and shell commands for local search operations.
- Sanitization: The workflow includes filtering to exclude non-competition list entries such as seminars or administrative notices from the final results.
Audit Metadata