The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx -y @nomadamas/k-skill@0 instruct korea-weather to fetch and follow dynamic instructions. This results in the execution of code downloaded from the npm registry at runtime.
[EXTERNAL_DOWNLOADS]: The skill downloads instructions and helper files from an external npm package and references a third-party GitHub repository (github.com/NomaDamas/k-skill).
[COMMAND_EXECUTION]: The workflow involves executing npx for setup, updates, and instruction retrieval, as well as curl to interact with an external proxy service.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an external API, which could be used to inject malicious instructions into the agent's context.
Ingestion points: Weather data is ingested from https://k-skill-proxy.nomadamas.org via curl in instruction.md.
Boundary markers: There are no markers or instructions provided to the agent to treat the API response as potentially untrusted data.
Capability inventory: The skill uses curl and npx, which provide network access and the ability to execute further code.
Sanitization: There is no evidence of validation or sanitization of the API response before the agent processes and summarizes the content.

korea-weather