lotto-results
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs global installation of the 'k-lotto' package using
npm install -gand modifies theNODE_PATHenvironment variable. It also executes Node.js code snippets via bash heredocs to interact with the package. - [EXTERNAL_DOWNLOADS]: The skill relies on downloading and installing an external package from the public NPM registry that is not from a recognized trusted vendor or the skill author.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data without validation or boundary markers.
- Ingestion points: Lottery results are fetched from external sources via the
k-lottolibrary. - Boundary markers: No delimiters or instructions are provided to the agent to ignore embedded instructions in the fetched data.
- Capability inventory: The skill has the ability to execute shell commands and Node.js scripts.
- Sanitization: No sanitization or filtering of the external data is performed before it is presented to the agent.
Audit Metadata