The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell command to run a Node.js script provided via standard input. This script dynamically constructs a file path based on environment variables and uses await import() to load and execute code from a local directory.
Evidence: `node --input-type=module
<<'JS' ... const { getKLeagueSummary } = await import(entry);inSKILL.md`.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install an external npm package kleague-results globally. This package is identified as a vendor-owned resource belonging to the author.
Evidence: npm install -g kleague-results in SKILL.md.
[COMMAND_EXECUTION]: The skill mandates a global installation (-g) of software, which typically requires elevated system privileges and makes system-wide changes.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from external JSON endpoints without explicit sanitization or boundary markers.
Ingestion points: https://www.kleague.com/getScheduleList.do, https://www.kleague.com/record/teamRank.do (referenced in SKILL.md).
Boundary markers: Absent.
Capability inventory: Shell command execution, dynamic module loading, and network access.
Sanitization: No sanitization or schema validation is implemented for the external data before processing.

kleague-results