The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and metadata multiple times direct the user or agent to run npx -y @nomadamas/k-skill@0. This command fetches and executes an external package from the NPM registry at runtime.
[COMMAND_EXECUTION]: The skill relies on shell commands for management, updates, and execution, specifically through the @nomadamas/k-skill CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its core function of scraping external product data.
Ingestion points: The scripts/danawa_search.py script fetches data (product titles, specifications, price text, and shop names) from search.danawa.com and prod.danawa.com.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the scripts or the instruction.md for the ingested data.
Capability inventory: The skill possesses network access (via Python's urllib.request) and shell command execution capabilities (via npx).
Sanitization: While the Python script performs basic HTML unescaping and text cleaning, it lacks specific sanitization logic to detect or neutralize malicious instructions embedded in the scraped product content.
[DYNAMIC_EXECUTION]: The Python helper script danawa_search.py uses regular expressions to extract JSON-like strings from HTML <script> tags and then parses them using json.loads(). While not using eval(), this involves processing structured data extracted dynamically from an external source.

danawa-price-search