The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx in its instructions to invoke its own CLI helper and Python scripts. This is the intended delivery mechanism for this specific agent environment to ensure instructions and scripts are up to date.
[DATA_EXPOSURE_AND_EXFILTRATION]: The Python script scripts/bok_ecos.py reads from ~/.config/k-skill/secrets.env to retrieve an API key (KSKILL_BOK_ECOS_API_KEY). This is a standard and safe practice for secret management in developer tools, and the data is only sent to the official Bank of Korea endpoint (ecos.bok.or.kr).
[REMOTE_CODE_EXECUTION]: While the skill instructions involve downloading and executing a package via npx, the source (@nomadamas/k-skill) corresponds to the skill's author, and the execution is restricted to the skill's own documented helper functions. This represents standard runtime behavior for this ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the ECOS API. The attack surface is minimal as the script projects the JSON response into a strict, predefined schema and uses a whitelist-based validation (SEGMENT_PATTERN) for all user-supplied URL segments, preventing path traversal or parameter injection.

bok-ecos-stats