The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary instructions in SKILL.md and instruction.md mandate the execution of a remote NPM package using npx -y @nomadamas/k-skill@0. This command downloads and executes unverified code from a third-party source at runtime to fetch instructions, list files, and execute the helper scripts.
[CREDENTIALS_UNSAFE]: The Python helper script scripts/highway_traffic.py is configured to read API keys from a hardcoded sensitive file path at ~/.config/k-skill/secrets.env. It specifically extracts values for KSKILL_EXDATA_API_KEY and KSKILL_ITS_API_KEY from this local file.
[EXTERNAL_DOWNLOADS]: The skill fetches real-time traffic data from https://data.ex.co.kr/openapi/odtraffic/trafficAmountByRealtime and CCTV metadata from https://openapi.its.go.kr:9443/cctvInfo. While these are official Korean government service endpoints, they represent external data ingestion points.
[COMMAND_EXECUTION]: The skill's workflow relies on the agent executing shell commands via npx to interact with the @nomadamas/k-skill framework and run the Python data retrieval script.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs (Korea Expressway Corporation and National Transport Information Center) and presents it to the agent without explicit sanitization or boundary markers. This creates a potential attack surface where malicious content embedded in the API responses could influence the agent's behavior.

highway-traffic-status