The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill directs the agent to execute the @nomadamas/k-skill@0 package via npx in SKILL.md. This command is used to fetch instructions, list files, and update the skill. Since the package content is external and versioned dynamically, it can execute arbitrary commands or provide malicious instructions at runtime.- [EXTERNAL_DOWNLOADS]: The skill relies on external resources, including the npm registry for the k-skill package and the https://k-skill-proxy.nomadamas.org domain for API requests.- [DYNAMIC_EXECUTION]: The skill implements a 'cli-stub' pattern where the actual instructions are not contained within the repository but are generated or retrieved dynamically by a script. This obfuscates the skill's true behavior from static analysis.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the KOPIS API, creating a potential vector for indirect prompt injection.
Ingestion points: API responses fetched via curl in instruction.md.
Boundary markers: None identified; external content is processed without explicit delimiters or safety warnings.
Capability inventory: The skill uses curl for network requests and npx for package execution.
Sanitization: No sanitization or validation of the retrieved API data is described before it is presented to the agent.

kopis-performance-search