The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute code from a remote source via npx -y @nomadamas/k-skill@0. This downloads and runs packages from the NPM registry that are not associated with a known trusted vendor.
[REMOTE_CODE_EXECUTION]: The use of npx to fetch instructions (npx -y @nomadamas/k-skill@0 instruct) and update the toolset allows for the execution of remote code at runtime.
[COMMAND_EXECUTION]: The skill relies on shell commands including curl to interact with the news API at https://mcp.hankookilbo.com/mcp and python3 for parsing JSON response data.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes news headlines, excerpts, and metadata from an external source (mcp.hankookilbo.com).
Ingestion points: Data enters the agent's context through the news API responses.
Boundary markers: The instructions provide guidelines to quote titles verbatim, which offers some content separation but no formal security boundaries.
Capability inventory: The skill utilizes curl for network requests and python3 for local data processing.
Sanitization: There is no evidence of sanitization or filtering applied to the external news content before it is interpolated into the agent's output.

hankookilbo-news