The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the npx utility to fetch and run tools from the NPM registry. These downloads include the @nomadamas/k-skill package, which is used to manage instructions, reference files, and updates for the skill.
[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md require the execution of code from an external NPM package (@nomadamas/k-skill) using npx. This allows for the runtime execution of tools not contained within the skill's own directory.
[DATA_EXFILTRATION]: The script scripts/popbill_cli.py implements a feature that reads the contents of local files when an argument is prefixed with @. While intended to facilitate complex JSON inputs, this mechanism creates a path for potentially exposing sensitive local files if an attacker provides a malicious file path to the agent.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to its file-reading capabilities.
Ingestion points: The --args-json and --kwargs-json parameters in the popbill_cli.py script which accept file paths via the @ prefix.
Boundary markers: There are no restrictions or path validation markers implemented to limit which files the agent can read using this feature.
Capability inventory: The skill can perform network operations via the Popbill SDK, read arbitrary local files (provided they contain valid JSON), and execute business-critical API calls.
Sanitization: No path sanitization or filtering is applied to the input following the @ prefix beyond the requirement that the resulting content must be parseable as JSON.
[COMMAND_EXECUTION]: The skill relies on the execution of a custom Python CLI (popbill_cli.py) that interacts with the Popbill SDK to perform financial and administrative tasks, including operations that mutate account states or send communications.

popbill