The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's instructions and the script scripts/zipcode_search.py pass user-supplied input directly to the curl --data-urlencode command. In curl, arguments following the pattern name@filename (e.g., keyword=@/etc/passwd) trigger the tool to read the contents of the specified local file and send it to the remote server. This allows for potential exfiltration of sensitive information if the agent is provided with a malicious query string.
[EXTERNAL_DOWNLOADS]: The skill's SKILL.md file instructs the agent to run npx -y @nomadamas/k-skill@0, which involves downloading and executing code from an external package registry. The source organization is not a recognized trusted vendor, creating a risk of supply chain attack or execution of untrusted code at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML content from an external website (epost.kr).
Ingestion points: External data is fetched from the official ePost integration search page and processed in scripts/zipcode_search.py.
Boundary markers: No explicit delimiters or boundary markers are used to isolate the fetched external content from the agent's instructional logic.
Capability inventory: The skill has the ability to execute network requests via curl and run shell commands via subprocess.run.
Sanitization: While the script uses regular expressions to extract specific address fields, it does not sanitize the content against instructions that might be embedded in the HTML, which could potentially influence the agent's behavior if the source site were compromised.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external binaries (curl) and script interpreters (python3) to perform its core functionality. The lack of strict input sanitization on the arguments passed to these subprocesses increases the overall attack surface.

zipcode-search