korean-marathon-schedule

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the npx command to fetch the @nomadamas/k-skill package from the official Node.js package registry. This tool is provided by the skill's author to display instructions and manage skill-related files.- [COMMAND_EXECUTION]: The skill performs its primary operations using node and npx commands to execute search scripts and retrieve event data. These commands are standard for the skill's documented functionality.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external marathon websites, which creates an attack surface for untrusted content.
  • Ingestion points: Public race list and detail pages from gorunning.kr and triathlon.or.kr as specified in instruction.md.
  • Boundary markers: The instructions provide a specific output format and mandate conservative summarization of event details.
  • Capability inventory: The skill uses network requests for web scraping and shell commands for local search operations.
  • Sanitization: The workflow includes filtering to exclude non-competition list entries such as seminars or administrative notices from the final results.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM
Security Audit — agent-trust-hub — korean-marathon-schedule