The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl to interact with the proxy API and npx to run vendor-specific tools.
Evidence: SKILL.md contains multiple npx -y @nomadamas/k-skill@0 commands; instruction.md provides curl examples for API interaction.
[EXTERNAL_DOWNLOADS]: The skill downloads the @nomadamas/k-skill package from the NPM registry at runtime to perform utility tasks and fetch instructions.
Evidence: SKILL.md uses npx which fetches packages from registry.npmjs.org if not locally cached.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx -y to execute a vendor-specific CLI package. This mechanism effectively functions as remote code execution to provide dynamic instructions to the agent.
Evidence: SKILL.md specifies: npx -y @nomadamas/k-skill@0 instruct korean-stock-search.
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from an external proxy server, which creates a vulnerability surface for indirect prompt injection if the upstream data is compromised.
Ingestion points: Data enters the agent context via HTTP responses from https://k-skill-proxy.nomadamas.org/ (documented in instruction.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the JSON response as untrusted data.
Capability inventory: The agent has shell execution capabilities via curl and npx as defined in SKILL.md and instruction.md.
Sanitization: No sanitization or validation of the external API content is mentioned before the agent interprets the results.

korean-stock-search