The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx -y @nomadamas/k-skill@0 for fundamental operations such as fetching primary instructions, listing skill files, and applying updates. This mechanism executes external, unverified code from a third-party NPM package at runtime.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to k-skill-proxy.nomadamas.org and apis.data.go.kr to obtain air quality reports and monitoring station metadata.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on external API data.
Ingestion points: Data is retrieved from the Air Korea service and a proxy server via urllib.request calls in scripts/fine_dust.py.
Boundary markers: There are no explicit delimiters or specific instructions for the agent to treat the external API content as untrusted data.
Capability inventory: The Python script scripts/fine_dust.py performs data parsing and printing; however, the agent's broader toolset could be leveraged if malicious instructions were successfully injected.
Sanitization: While the script parses numeric values, it does not sanitize or escape descriptive strings (like stationName or addr) before displaying them to the agent.
[CREDENTIALS_UNSAFE]: The skill utilizes the AIR_KOREA_OPEN_API_KEY environment variable. The instructions suggest managing this secret via .env files, which is a standard procedure but confirms that the skill requires sensitive API credentials to operate in direct mode.

fine-dust-location