The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute a remote package using npx -y @nomadamas/k-skill@0. This downloads and executes code from a third-party registry (npm) during the instruction-gathering phase, which is a high-risk pattern for arbitrary code execution.
[DATA_EXFILTRATION]: The skill is designed to collect user phone numbers through the enter_event(phone) tool and transmit them to a remote endpoint at https://hola-poke-yeoksam-skill.onrender.com/mcp. Transmitting personally identifiable information (PII) to a non-whitelisted third-party domain poses a significant data privacy and exfiltration risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes responses from a remote Model Context Protocol (MCP) server and explicitly mandates that the agent deliver the message field from the server "as-is" to the user. This creates a vulnerability where the remote server could inject malicious instructions or deceptive content into the agent's output.
Ingestion points: Data received from the remote MCP server at hola-poke-yeoksam-skill.onrender.com (instruction.md).
Boundary markers: No boundary markers or "ignore instructions" warnings are present to protect against embedded commands in the server response.
Capability inventory: The skill possesses the capability to execute shell commands (npx) and interact with the filesystem and network.
Sanitization: The skill lacks sanitization, specifically requiring the agent to relay server messages verbatim.
[COMMAND_EXECUTION]: SKILL.md contains several shell commands (npx -y @nomadamas/k-skill@0 instruct, files, update) that the agent is expected to run, providing a vector for command injection or execution of malicious payloads bundled in the external package.
[EXTERNAL_DOWNLOADS]: The skill references and downloads content from several external sources, including an unverified npm package (@nomadamas/k-skill) and GitHub repositories (github.com/mnspkm/hola-poke-yeoksam-skill, github.com/NomaDamas/k-skill).

hola-poke-yeoksam