The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions frequently utilize npx -y @nomadamas/k-skill@0 to fetch instructions, update the skill, and read references. This involves downloading and running code from an NPM package owned by an organization ('nomadamas') that is not recognized as a trusted vendor.
[REMOTE_CODE_EXECUTION]: By using the @nomadamas/k-skill CLI to execute the skill's Python scripts (e.g., npx ... exec ... scripts/naver_search.py), the skill delegates execution control to an external package, which could be updated to include malicious behavior.
[COMMAND_EXECUTION]: The Python scripts (naver_search.py, naver_read.py, naver_download_images.py) implement an --insecure command-line flag. When used, this flag disables SSL/TLS certificate verification via the ssl.CERT_NONE setting in scripts/_naver_http.py. Although limited to Naver-owned domains and accompanied by a warning, this practice facilitates man-in-the-middle attacks where an attacker could intercept or modify traffic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, attacker-controllable sources (Naver blog posts).
Ingestion points: Content is retrieved from the web in scripts/naver_read.py and scripts/naver_search.py.
Boundary markers: There are no delimiters or specific instructions provided to the agent to treat the fetched content as data rather than instructions.
Capability inventory: The skill has the ability to write files to the disk and perform network requests.
Sanitization: The extraction process cleans HTML tags but does not sanitize the text for natural language instructions that could trigger unintended agent actions.

naver-blog-research