The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's documentation (SKILL.md and instruction.md) repeatedly instructs the agent to run commands using npx, such as npx -y @nomadamas/k-skill@0 instruct and npx -y @nomadamas/k-skill@0 update. This encourages the execution of remote code on the user's host system.
[EXTERNAL_DOWNLOADS]: The skill depends on the @nomadamas/k-skill package, which is fetched from the NPM registry at runtime. This package is managed by a third-party organization (NomaDamas) that is not recognized as a trusted vendor, representing a supply chain vulnerability.
[INDIRECT_PROMPT_INJECTION]: The skill processes and displays raw data fetched from the KOSIS Open API and a third-party proxy, which could potentially contain malicious instructions targeting the agent.
Ingestion points: The call_kosis function in scripts/run_kosis_stats.py fetches content from external URLs (kosis.kr and nomadamas.org).
Boundary markers: The skill does not provide clear delimiters or 'ignore' instructions when presenting external data to the agent.
Capability inventory: The skill possesses network access and file system read capabilities.
Sanitization: The script performs JSON structure correction but does not sanitize the content of the data fields for natural language instructions.

kosis-stats