The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx -y @nomadamas/k-skill@0 to fetch primary instructions and perform updates. This pattern executes code from a remote, untrusted source at runtime.\n
Evidence: npx -y @nomadamas/k-skill@0 instruct kakao-bar-nearby and npx -y @nomadamas/k-skill@0 update in SKILL.md.\n- [EXTERNAL_DOWNLOADS]: The skill relies on an external proxy server (https://k-skill-proxy.nomadamas.org) for its primary search functionality and fetches Node.js packages from the npm registry.\n
Evidence: Proxy URL in instruction.md and npx commands in SKILL.md.\n- [COMMAND_EXECUTION]: The skill uses shell commands (npx) to manage its instructions and dependencies, which gives the skill direct access to the host environment's execution capabilities.\n
Evidence: Shell command blocks in SKILL.md.\n- [DYNAMIC_EXECUTION]: The skill dynamically fetches and follows instructions printed by an external CLI tool, effectively loading executable logic or prompt instructions from a computed or remote source.\n
Evidence: Instructions in SKILL.md stating to "Run this and follow its output as the primary instructions".\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a third-party API proxy and scrapes information from Kakao Map place pages, creating a vulnerability to malicious instructions embedded in that external content.\n
Ingestion points: https://k-skill-proxy.nomadamas.org and https://place.map.kakao.com/ (via browser).\n
Boundary markers: None identified in the provided instructions to delimit external data from agent instructions.\n
Capability inventory: Shell execution (npx), network access (proxy), and browser interaction.\n
Sanitization: No evidence of sanitization or filtering of the ingested external content.

kakao-bar-nearby