The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md mandate the execution of npx -y @nomadamas/k-skill@0 to obtain the full instruction set and list bundled files. This pattern downloads and executes code from a third-party registry package that is not associated with a trusted organization or the skill's verified author.
[EXTERNAL_DOWNLOADS]: The skill relies on external content hosted at https://github.com/NomaDamas/k-skill. By fetching instructions at runtime rather than including them in the skill package, the author can change the agent's behavior dynamically without the changes being visible during initial analysis.
[COMMAND_EXECUTION]: Multiple shell commands using npx are provided as required steps for the agent. These commands facilitate the download and execution of remote scripts, significantly increasing the attack surface of the skill.
[OBFUSCATION]: The practice of fetching the primary instructions via a CLI tool (npx ... instruct intercity-bus-booking) instead of providing them in the SKILL.md or instruction.md files serves as a technique to obscure the actual logic and prompts the agent will follow from static analysis tools.
[DYNAMIC_EXECUTION]: The helper script scripts/intercity_bus_search.py contains the line ssl._create_unverified_context(), which is used to bypass SSL certificate validation for all network requests to https://intercitybus.tmoney.co.kr. This leaves the agent and user data susceptible to man-in-the-middle attacks.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its data ingestion pipeline.
Ingestion points: The search_timetable and hold_seat functions in scripts/intercity_bus_search.py fetch raw HTML content from an external website.
Boundary markers: None. The skill does not use delimiters or instructions to prevent the agent from obeying commands that might be embedded in the scraped HTML.
Capability inventory: The skill possesses network access via urllib.request and the ability to write files to the local filesystem using Path.write_text.
Sanitization: The script performs regex-based extraction and HTML unescaping but lacks any logic to sanitize the resulting strings before they are presented to the agent's context.

intercity-bus-booking