The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @nomadamas/k-skill and kleague-results packages from the public npm registry. These packages originate from an organization and author that are not recognized as trusted or well-known entities.
Evidence in SKILL.md: npx -y @nomadamas/k-skill@0 instruct kleague-results
Evidence in instruction.md: npm install -g kleague-results
[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute code from a remote repository at runtime. This practice allows for the execution of arbitrary code that is not contained within the skill's source files.
Evidence in SKILL.md: npx -y @nomadamas/k-skill@0 update and npx -y @nomadamas/k-skill@0 instruct kleague-results
[COMMAND_EXECUTION]: The instructions direct the AI agent to execute multiple shell commands, including global package installations and updating CLI tools, which requires elevated privileges or environment modification.
Evidence in instruction.md: npm install -g kleague-results and shell-based Node.js execution.
[DYNAMIC_EXECUTION]: The skill uses a Node.js script to dynamically import and execute modules from a globally installed package. This execution pattern makes it difficult to verify the actual logic being performed by the agent as the source code is loaded from the filesystem at runtime.
Evidence in instruction.md: const { getKLeagueSummary } = await import(entry); where entry is a dynamically constructed file URL.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external JSON endpoints which could theoretically contain instructions that influence the agent's behavior.
Ingestion points: The skill fetches data from https://www.kleague.com/getScheduleList.do and https://www.kleague.com/record/teamRank.do as specified in instruction.md.
Boundary markers: None identified. The skill does not use specific delimiters to separate external data from agent instructions.
Capability inventory: The skill has the ability to execute shell commands (npm, npx, node), access the network, and read/write to the global npm root directory.
Sanitization: No explicit sanitization or validation of the fetched JSON content is mentioned in the prompt instructions, relying entirely on the external package logic.

kleague-results