The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill relies on npx -y commands to download and execute instructions and utility scripts from the @nomadamas/k-skill@0 package. This allows the package maintainer to execute arbitrary code on the system during the skill's setup and operation, including through subcommands like update and instruct.
[DYNAMIC_EXECUTION]: The instruction workflow uses a Node.js shell script to dynamically import the kbl-results package from the global node_modules directory using a computed path (npm root -g). This dynamic loading of modules from paths derived from environment variables can be a vector for executing unexpected code if the environment is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external endpoints https://api.kbl.or.kr/match/list and https://api.kbl.or.kr/league/rank/team.
Ingestion points: Data enters via the getKBLSummary function fetching from api.kbl.or.kr as described in instruction.md.
Boundary markers: None are present to distinguish API data from instructions.
Capability inventory: The skill has shell execution capabilities via npm, npx, and node in SKILL.md and instruction.md.
Sanitization: There is no evidence of data sanitization or validation before the JSON response is processed and presented.
[EXTERNAL_DOWNLOADS]: The skill performs global package installations using npm install -g kbl-results and fetches remote instruction sets via npx from non-whitelisted external repositories.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage dependencies and run its logic, including npm install, npx, and node --input-type=module.

kbl-results