The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions for the agent to run shell commands using npx to fetch its core logic. Specifically, npx -y @nomadamas/k-skill@0 instruct public-restroom-nearby is described as a "required first step" to get the primary instructions. This allows the remote package to dynamically define the agent's behavior at runtime.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command patterns including npx for listing files and updating the skill environment. The use of the -y flag in these commands ensures they execute without user confirmation, increasing the risk of silent execution of potentially malicious remote code.
[EXTERNAL_DOWNLOADS]: The skill workflows involve fetching CSV datasets from Korean government domains (data.go.kr, localdata.go.kr) and interacting with Kakao map services. Additionally, it requires the installation/execution of the @nomadamas/k-skill package and references a Node.js package public-restroom-nearby which are not from a verified or well-known vendor list.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied location strings which are then used in external API queries and data lookups.
Ingestion points: User-provided location strings (landmarks, station names, coordinates) are captured in instruction.md via the mandatory first question.
Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for the user-supplied location data.
Capability inventory: The skill has the capability to execute shell commands (npx), execute Node.js code (require), perform network requests (fetch CSVs), and write to the console.
Sanitization: The workflow uses an "anchor resolution" step via the Kakao Map API to convert location strings into coordinates, which provides a level of normalization for the input.

public-restroom-nearby