The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires the agent to run npx -y @nomadamas/k-skill@0 to retrieve its primary instructions and perform updates, which involves downloading and executing unverified code from an external package registry.
[EXTERNAL_DOWNLOADS]: All book search, details, and library holding queries are routed through a third-party proxy at https://k-skill-proxy.nomadamas.org. This domain is not identified as a trusted or well-known service provider.
[COMMAND_EXECUTION]: The skill uses shell-based tools including npx and curl to manage documentation, perform updates, and interact with external APIs.
[DYNAMIC_EXECUTION]: The use of npx represents a dynamic execution pattern where external code is loaded and run at runtime without prior integrity verification.
[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data from the proxy API, creating a vulnerability surface for instruction injection.
Ingestion points: Data retrieved via curl from the /v1/data4library/ endpoints described in instruction.md.
Boundary markers: The instructions lack markers or warnings to prevent the agent from executing instructions found within the retrieved book metadata.
Capability inventory: The skill has the ability to execute shell commands (npx, curl).
Sanitization: No sanitization or validation of the API response content is defined before the data is processed by the agent.

library-book-search