The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a Node.js implementation example that requires a package named cheap-gas-nearby. This package is not a standard library or part of a well-known organization's ecosystem, representing an unverified dependency.
[DATA_EXFILTRATION]: The skill is configured to route all traffic to fuel price services through a custom proxy server at k-skill-proxy.nomadamas.org.
User-provided location strings, landmark names, and coordinates are transmitted to this external domain.
While the skill documentation claims this is for API key management, it creates a persistent data flow of potentially sensitive user location data to an unverified third-party infrastructure.
[PROMPT_INJECTION]: The skill processes untrusted user data when resolving locations, making it a surface for indirect prompt injection.
Ingestion points: The skill explicitly requests and processes the user's current location string (neighborhood, station name, or landmark).
Boundary markers: The instructions do not define any delimiters or system-level warnings to prevent the agent from interpreting instructions embedded within the user's location input.
Capability inventory: The skill possesses network capabilities to interact with k-skill-proxy.nomadamas.org and Kakao Map APIs.
Sanitization: There is no mention of input validation or sanitization for the location string before it is interpolated into API request paths or search queries.

cheap-gas-nearby