The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute code from NPM packages using npx at runtime to perform core functions and retrieve instructions.
Evidence in SKILL.md: npx -y @nomadamas/k-skill@0 instruct bunjang-search is presented as a required first step to get instructions.
Evidence in SKILL.md: npx -y @nomadamas/k-skill@0 update is recommended to keep the skill current.
Evidence in instruction.md: Frequent use of npx --yes bunjang-cli for search, login, and item retrieval operations.
[EXTERNAL_DOWNLOADS]: The skill fetches its primary operational logic and documentation from external sources not identified as trusted vendors.
Evidence in SKILL.md: Links to https://github.com/NomaDamas/k-skill/blob/main/bunjang-search/instruction.md for source instructions.
The package @nomadamas/k-skill and CLI tool bunjang-cli are hosted on public registries without verification of the maintainers' identity relative to the skill author.
[COMMAND_EXECUTION]: The skill makes heavy use of shell commands to interact with the system and external APIs.
Evidence in instruction.md: Commands such as npx --yes bunjang-cli search "아이폰" and npx --yes bunjang-cli item get 354957625 execute shell processes to interact with the marketplace.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an external, attacker-controllable source (the Bunjang marketplace) and has the capability to execute shell commands.
Ingestion points: Marketplace search results and item descriptions retrieved via bunjang-cli in instruction.md.
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are present in the scripts when processing item descriptions.
Capability inventory: The skill has the ability to execute shell commands via npx (e.g., in instruction.md).
Sanitization: There is no evidence of sanitization for the marketplace data before it is processed or displayed by the agent.

bunjang-search