The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill mandates the execution of code from an external, untrusted source via npx -y @nomadamas/k-skill@0. The -y flag explicitly bypasses the standard confirmation prompt, resulting in immediate execution of arbitrary code from the network upon the agent's first step.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of an unverifiable third-party npm package naming-house and fetches additional instructions and files from the NomaDamas GitHub repository.
[COMMAND_EXECUTION]: The workflow involves shell commands for global package installation (npm install -g), environment variable modification (export NODE_PATH), and piping scripts directly into the Node.js runtime.
[DYNAMIC_EXECUTION]: The skill generates JavaScript code at runtime and executes it via the shell using heredocs (`node
<<'JS'`). This pattern creates a vector for executing dynamically constructed logic outside of pre-defined scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data—such as birth details, city of birth, and candidate name strings—which are interpolated into shell commands and Node.js scripts. There is a lack of explicit sanitization or boundary markers to prevent malicious input from altering the intended execution logic of the naming-house tool calls.

naming-house