The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute code from the @nomadamas/k-skill package at runtime. This creates a dependency on external code hosted on the npm registry.
[COMMAND_EXECUTION]: The skill instructs the agent to run several shell commands using npx to fetch updated instructions, list files, and execute the core survey logic through scripts/run_survey.py.
[DATA_EXFILTRATION]: The survey script makes network requests to k-skill-proxy.nomadamas.org to retrieve grant information. While this is the primary function of the skill, it involves sending user-supplied keywords and parameters to a third-party domain.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted JSON data from external government support portals via a proxy, which could contain adversarial content designed to influence agent behavior.
Ingestion points: scripts/run_survey.py (line 46) fetches JSON data from https://k-skill-proxy.nomadamas.org.
Boundary markers: No specific delimiters or boundary markers are implemented in the script to isolate external data from the prompt context.
Capability inventory: The skill possesses the ability to execute shell commands via npx and perform network operations via Python's urllib.
Sanitization: The fetched grant data is not sanitized or filtered before being presented to the agent for classification.
[DYNAMIC_EXECUTION]: The agent's primary instructions are fetched dynamically from a remote source at runtime using a CLI tool, meaning the skill's logic can be modified without changing the static files distributed in the skill package.

government-support-survey