The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute instructions from a remote package @nomadamas/k-skill@0. * Evidence: SKILL.md contains multiple npx -y @nomadamas/k-skill@0 commands, including instruct, files, update, and read. * Impact: The operational logic is retrieved from a registry at runtime, creating a dependency on the integrity of the remote package and registry.
[COMMAND_EXECUTION]: The skill instructs the agent to perform a global package installation and execute shell commands for processing. * Evidence: instruction.md explicitly commands npm install -g kbo-game if the package is missing, and uses a shell script to pipe code into Node.js. * Impact: Global installations can modify the system environment and typically require elevated permissions, while piped shell commands can be harder to audit.
[DYNAMIC_EXECUTION]: The skill utilizes a Node.js script that dynamically loads a module from a path resolved at runtime. * Evidence: instruction.md includes a script that runs npm root -g to find the installation directory and then calls await import(entry) on a constructed file URL. * Impact: Dynamic loading from environment-dependent paths can be exploited if the environment or the resolution process is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external sports data. * Ingestion points: The getGame function in instruction.md fetches external data from the KBO website via the kbo-game package. * Boundary markers: Absent; there are no instructions to the agent to treat the fetched data as potentially untrusted or to use specific delimiters. * Capability inventory: The skill can execute shell commands (npm, node) and perform dynamic module imports. * Sanitization: Absent; the skill relies on the LLM's natural language processing to summarize the raw JSON data without specific security filtering.

kbo-results