The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Fetches merchant information from the eat.pl API (via proxy) and scrapes Kakao Map mobile search pages for ratings in scripts/kakao-place-rating.mjs.
Boundary markers: None identified; the skill processes the ingested data directly into a table for the user.
Capability inventory: The skill performs network requests (curl, fetch) and executes a bundled script via npx.
Sanitization: The helper script uses regex-based parsing to extract data from HTML content but lacks comprehensive prompt injection sanitization for the final interpolated output.
[EXTERNAL_DOWNLOADS]: The skill fetches its full instructions and executes helper scripts using the author's own command-line tool.
Evidence: npx -y @nomadamas/k-skill@0 instruct bccard-eatpl-search and npx -y @nomadamas/k-skill@0 exec ... calls in SKILL.md and instruction.md.
Context: The package @nomadamas/k-skill is a vendor-owned resource from the skill author (nomadamas).
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to fetch instructions and run local helper scripts.
Evidence: curl commands in instruction.md and multiple npx calls in SKILL.md used for obtaining instructions and reading references.

bccard-eatpl-search