The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires the agent to run npx -y @nomadamas/k-skill@0 instruct housing-official-price as a mandatory first step to obtain instructions. This pattern executes code downloaded from a remote, untrusted third-party package registry at runtime.
[EXTERNAL_DOWNLOADS]: The skill relies on the external NPM package housing-official-price, which is fetched from a third-party registry and is not a resource from a trusted vendor.
[DYNAMIC_EXECUTION]: The instructions provide multiple shell commands using node -e to execute concatenated JavaScript strings. This pattern of dynamic code assembly and execution increases the risk of code injection if inputs are not properly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a public web surface (realtyprice.kr), creating an attack surface for indirect prompt injection.
Ingestion points: Data is fetched from realtyprice.kr via the housing-official-price package as described in instruction.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the fetched data are present.
Capability inventory: The skill possesses the capability to execute shell commands (npx, node), install packages, and perform network requests.
Sanitization: While the skill mentions normalized JSON output, there are no documented sanitization or filtering steps for the content retrieved from the external site.

housing-official-price