The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y @nomadamas/k-skill@0 to fetch and display its full operating instructions and bundled files from a remote package registry.
[DATA_EXFILTRATION]: The skill collects user phone numbers for the enter_event function and transmits them to the remote MCP server located at hola-poke-yeoksam-skill.onrender.com. The instructions include privacy notices stating that this data is only for entry comparison and not for marketing or third-party sharing.
[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect injection surface as it ingests data from a remote MCP server.
Ingestion points: Data is received from the get_menu, get_shop_info, and enter_event tools in instruction.md.
Boundary markers: The instructions explicitly direct the agent to deliver the server's message field content literally without modification, creating a surface where a compromised server could inject instructions into the user dialogue.
Capability inventory: The skill has the capability to make network requests to the specified remote MCP endpoint.
Sanitization: While menu data is summarized, the event entry responses are passed through without sanitization.

hola-poke-yeoksam