The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user or agent to execute commands using npx to fetch instructions and updates.
Evidence: npx -y @nomadamas/k-skill@0 instruct biz-health-check, npx -y @nomadamas/k-skill@0 update, and npx -y @nomadamas/k-skill@0 exec ... in SKILL.md and instruction.md.
[DYNAMIC_EXECUTION]: The main Python script dynamically loads and executes other Python scripts located in sibling directories based on a hardcoded mapping.
Evidence: scripts/biz_health_check.py uses importlib.util.spec_from_file_location and spec.loader.exec_module to load scripts like nts_business_registration.py and national_pension_workplace.py from computed paths relative to the current script.
[EXTERNAL_DOWNLOADS]: The skill relies on downloading and executing code from a remote NPM registry at runtime via npx.
Evidence: References to @nomadamas/k-skill@0 in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from multiple external public APIs (National Tax Service, National Pension Service, etc.) to generate a business health report. If this report is subsequently processed by an AI agent, malicious content within the API responses could influence agent behavior.
Ingestion points: scripts/biz_health_check.py queries external providers for business status, pension data, corporate info, and tax delinquency.
Boundary markers: Absent; the results are aggregated into a JSON structure and printed without explicit instruction delimiters or 'ignore' warnings for the downstream agent.
Capability inventory: The skill has file-read capabilities (to load scripts) and performs network operations (via proxy calls to government APIs).
Sanitization: The business registration number (b_no) is validated via regex (r'\d{10}'), and other inputs are stripped of whitespace, but the content returned from the external APIs is not sanitized for potential prompt injection patterns.

biz-health-check