The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation in SKILL.md and instruction.md instructs users to run npx -y @nomadamas/k-skill@0 for various administrative tasks such as viewing instructions, listing files, and updating the skill. This pattern allows for the execution of remote code fetched from the npm registry at runtime.
[EXTERNAL_DOWNLOADS]: The skill relies on external content from the @nomadamas/k-skill npm package and the NomaDamas/k-skill repository on GitHub.
[DATA_EXFILTRATION]: The helper script scripts/run_kstartup.py is configured to read a sensitive local file path at ~/.config/k-skill/secrets.env to retrieve stored API keys.
[COMMAND_EXECUTION]: The skill instructions involve executing shell commands through npx to perform search operations and manage local skill files.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect injection surface because it processes and summarizes external data from search results.
Ingestion points: External API responses from k-skill-proxy.nomadamas.org and apis.data.go.kr are processed in scripts/run_kstartup.py.
Boundary markers: No explicit boundary markers or instructions are provided to the agent in the script's output to help it distinguish search content from potential instructions.
Capability inventory: The skill possesses network access via urllib.request and local file system read access for configuration files, both defined in scripts/run_kstartup.py.
Sanitization: The script performs standard data processing but does not implement specific sanitization to mitigate prompt injection risks within the summarized search results.

kstartup-search