The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent or user to execute npx commands to retrieve the latest instructions, list files, and update the skill components.
Evidence: npx -y @nomadamas/k-skill@0 instruct naver-news-search in SKILL.md.
Evidence: npx -y @nomadamas/k-skill@0 update in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill fetches news search results from an external proxy and downloads instructions/files using the npx package manager.
Evidence: curl -fsS --get "${KSKILL_PROXY_BASE_URL:-https://k-skill-proxy.nomadamas.org}/v1/naver-news/search" in instruction.md.
Evidence: External GitHub link https://github.com/NomaDamas/k-skill/blob/main/naver-news-search/instruction.md used for manual instruction retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted news titles and summaries from the Naver News API, which could potentially contain malicious instructions meant to influence the agent's behavior.
Ingestion points: items[].title and items[].description fields retrieved from the proxy in instruction.md.
Boundary markers: The proxy server removes <b> tags and HTML entities, and the skill instructions recommend framing summaries with phrases like "according to the summary."
Capability inventory: The skill has the ability to execute network requests via curl and shell commands via npx as outlined in SKILL.md and instruction.md.
Sanitization: Proxy-side removal of HTML tags and entities is implemented to normalize the data before the agent processes it.

naver-news-search