The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md direct the agent to run npx -y @nomadamas/k-skill@0, which downloads code from the NPM registry to provide dynamic instructions and updates.
[REMOTE_CODE_EXECUTION]: The use of npx to fetch and execute the @nomadamas/k-skill package constitutes the execution of unverified external code within the agent's environment.
[COMMAND_EXECUTION]: The skill uses curl to make network requests to an external proxy server (k-skill-proxy.nomadamas.org) to retrieve holiday data.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a third-party API, creating a surface for potential instruction injection if the upstream content is modified by an attacker.
Ingestion points: instruction.md fetches data via curl from https://k-skill-proxy.nomadamas.org/v1/korean-holiday/calendar.
Boundary markers: None present; the skill lacks delimiters or warnings to ignore instructions that might be embedded in the API response.
Capability inventory: The skill utilizes curl for network access and npx for command execution/package management.
Sanitization: No evidence of sanitization or validation of the external API response before the agent processes it.

korean-holiday-calendar