The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation in SKILL.md instructs the user or agent to run commands such as npx -y @nomadamas/k-skill@0 instruct boim-business-search. This pattern involves downloading and executing code from the NPM registry at runtime. As this package belongs to the skill's author, it is categorized as a vendor resource used for skill management and instruction delivery.
[COMMAND_EXECUTION]: The skill's workflow in instruction.md relies on the curl command to perform GET requests to the boim.io search endpoint and retrieve business data.
[EXTERNAL_DOWNLOADS]: The skill fetches external data from https://boim.io for search results and business details. It also references external documentation hosted on github.com.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external search service, which could potentially contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data is retrieved from https://boim.io/search/ and https://boim.io/vendors/c/.../ai.md via curl commands.
Boundary markers: The instructions do not specify any delimiters or safety prompts to isolate the external content from the agent's core instructions.
Capability inventory: The skill has the capability to execute shell commands (curl).
Sanitization: There is no mention of sanitizing or validating the retrieved JSON or Markdown content before it is processed by the agent.

boim-business-search