The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions specify the global installation of the kbo-game package from the npm registry. This introduces a dependency on a third-party package not maintained by a well-known vendor.
[COMMAND_EXECUTION]: The skill uses shell commands to install software (npm install -g) and executes an inline Node.js script using the node --input-type=module flag with a heredoc.
[REMOTE_CODE_EXECUTION]: Within the Node.js script, the skill performs a dynamic import (await import(entry)) of a file located at a path constructed at runtime using the GLOBAL_NPM_ROOT environment variable. This pattern is used to bridge the globally installed package with the execution environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from external sports results.
Ingestion points: Data returned from the getGame function in the Node.js script within SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potential instructions embedded in the game data.
Capability inventory: The skill possesses the ability to execute shell commands and install packages.
Sanitization: No data validation or escaping is applied to the retrieved game information before it is processed by the agent.

kbo-results