The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local Node.js script (htm.mjs) to act as a wrapper for the unofficial Mijn HTM API. This is the intended primary function for managing transport account data.
[INDIRECT_PROMPT_INJECTION]: The skill processes trip history data retrieved from external HTM services, which constitutes a potential attack surface.
Ingestion points: The skill fetches data in htm.mjs from the HTM portal endpoint https://www.htm.nl/v1/PortalCustomer/Trips.
Boundary markers: There are no explicit security delimiters or instructions to ignore embedded content when presenting stop names or trip details to the agent.
Capability inventory: The skill has the capability to perform network requests via fetch to HTM domains and read local files like regio-catalog.json using fs.readFileSync.
Sanitization: No specific filtering or sanitization of stop names from the transport API is performed before the data is integrated into the agent's context.

htm