The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx to fetch and execute its own instructions and stubs. These commands target the official @nomadamas/k-skill package, which aligns with the skill author's verified identity ('nomadamas').
[EXTERNAL_DOWNLOADS]: The Python script run_survey.py fetches government grant metadata from https://k-skill-proxy.nomadamas.org. This is a vendor-owned resource used to aggregate data from multiple official Korean government portals (K-Startup, Bizinfo, NIPA, KOCCA, SMTECH). The use of a proxy for cross-domain data aggregation is a standard architecture for this type of service.
[CREDENTIALS_SAFE]: The skill explicitly includes hard rules in SKILL.md and instruction.md against printing or storing plaintext credentials. It instructs the agent to never bypass identity-proofing or electronic-signature boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (grant announcements). While this is a known attack surface for indirect prompt injection, the skill implements several mitigations:
[Capability Inventory]: The skill's scripts are restricted to read-only HTTP GET requests to a specific proxy and outputting JSON to stdout. It lacks file-write or general network-send capabilities for exfiltration.
[Sanitization]: The script uses standard JSON parsing and output (json.load/json.dump) which prevents basic injection into the data stream.
[Boundary Markers]: Instructions explicitly warn the agent not to trust grant titles alone and to verify details via official URLs before making any suitability judgements.
[PRIVILEGE_ESCALATION]: The skill operates within a standard user context. It includes explicit rules against executing payments or submissions without immediate, explicit user approval.
[METADATA_POISONING]: All metadata fields (name, description) accurately reflect the skill's purpose and do not contain deceptive instructions.

government-support-survey