The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md and instruction.md prompt the agent to use npx -y @nomadamas/k-skill@0 to fetch instructions and execute scripts. This pattern involves downloading and running code from a remote registry (NPM) that is not part of the defined trusted vendor list.
[EXTERNAL_DOWNLOADS]: The skill fetches content from https://ohou.se/commerces/today_deals to perform its primary function. While this is expected behavior for a price-tracking skill, the data is from an external, untrusted source.
[INDIRECT_PROMPT_INJECTION]: The skill processes HTML and JSON data from an external website (ohou.se), creating a vulnerability surface where malicious instructions could be embedded in product titles or descriptions to influence agent behavior.
Ingestion points: The fetch_html and extract_next_data functions in scripts/ohou_today_deal.py ingest data from the external URL.
Boundary markers: The skill does not implement explicit boundary markers or "ignore instructions" warnings when presenting the scraped data to the agent.
Capability inventory: The skill can perform network requests and read local files (via the --html-file argument).
Sanitization: The script uses html.unescape and standard JSON parsing but lacks specific sanitization to prevent the interpretation of data as instructions.

ohou-today-deal