The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to execute code from an external package using npx -y @nomadamas/k-skill@0. This mechanism allows for the execution of remote scripts that are not part of the skill's source code and can be modified by the package maintainer at any time without updates to the skill repository itself.
Evidence: npx -y @nomadamas/k-skill@0 instruct daangn-used-goods-search (SKILL.md)
Evidence: npx -y @nomadamas/k-skill@0 exec daangn-used-goods-search scripts/daangn_used_goods.py ... (instruction.md)
[EXTERNAL_DOWNLOADS]: The skill functionality depends on downloading the @nomadamas/k-skill package from the public NPM registry. This package does not originate from a recognized trusted organization or the listed skill author.
[COMMAND_EXECUTION]: The skill frequently uses the npx command to invoke its logic, which is a high-risk pattern as it combines downloading and execution of external code in a single command.
[INDIRECT_PROMPT_INJECTION]: The skill ingests item listings from the Daangn marketplace, which contains attacker-controllable text such as titles and descriptions.
Ingestion points: scripts/daangn_used_goods.py fetches JSON data from https://www.daangn.com/kr/buy-sell/.
Boundary markers: Absent; the script outputs raw JSON directly to the agent's context without delimiters or warnings.
Capability inventory: The skill utilizes network access and shell command execution capabilities.
Sanitization: No sanitization or filtering of the external marketplace content is performed before interpolation into the agent's context.

daangn-used-goods-search