The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary instructions in SKILL.md direct the user to run multiple npx commands (e.g., npx -y @nomadamas/k-skill@0 instruct toss-investment). npx is a utility that downloads and executes code directly from the NPM registry. This specific package @nomadamas/k-skill belongs to an unverified organization ('nomadamas') that is not identified as a trusted vendor and does not match the skill author's known naming patterns ('min9lin9').
[COMMAND_EXECUTION]: The skill relies on shell command execution via npx for core functionality, including retrieving instructions, listing bundled files, and performing updates. This creates a dependency on an external CLI tool with arbitrary execution capabilities on the host system.
[EXTERNAL_DOWNLOADS]: The skill fetches its primary operational logic and configuration from external remote sources, specifically the @nomadamas/k-skill package and the NomaDamas GitHub repository, rather than providing the logic within the skill files themselves.
[CREDENTIALS_UNSAFE]: The instruction.md file requires the storage and use of sensitive financial credentials (TOSSINVEST_CLIENT_ID, TOSSINVEST_CLIENT_SECRET) as environment variables. While the instructions advise against printing these secrets, they are processed by the external helper library and CLI, creating a risk of credential exfiltration if the external tools are compromised.
[METADATA_POISONING]: The skill metadata and README use dense legalistic language and references to Korean Supreme Court precedents to establish an appearance of legitimacy and safety. However, this is combined with high-risk remote execution patterns from unverified sources, which is a common technique to lower user suspicion.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes user queries to interact with financial APIs and executes external scripts. Although it contains explicit instructions to remain read-only, the underlying execution mechanism (unverified external CLI) could be manipulated via tool output poisoning or schema confusion if the remote source is compromised.
Ingestion points: User prompts for financial data retrieval (e.g., 'Show me my holdings') and external API responses from openapi.tossinvest.com.
Boundary markers: The skill includes 'Hard rules' in SKILL.md and an 'Official-only boundary' in instruction.md to restrict behavior.
Capability inventory: Access to financial credentials, shell command execution (npx), network access to official financial APIs, and local file read capabilities for disclaimers.
Sanitization: The instructions claim the helper masks secrets in error messages, but this behavior is implemented in the unverified external package and cannot be locally audited.

toss-investment