The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute the @nomadamas/k-skill package from the npm registry using npx. This is used to retrieve the primary instructions and helper files for the skill. This represents a dependency on an external package registry and vendor-specific code.
[COMMAND_EXECUTION]: The skill uses curl to interact with an external API proxy (k-skill-proxy.nomadamas.org) to search for school information and retrieve meal data. This involves sending user-supplied parameters (school name, education office) to an external service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external source (the NEIS portal via a proxy) and summarizes it for the user, which presents a surface for tool output poisoning.
Ingestion points: instruction.md (via curl calls to the /v1/neis/school-search and /v1/neis/school-meal endpoints).
Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to ignore instructions embedded in the API responses.
Capability inventory: The skill utilizes curl for network requests and npx for executing a local CLI tool.
Sanitization: Limited to converting HTML break tags (<br/>) to newlines; no specific sanitization or filtering for prompt injection patterns is mentioned.

k-schoollunch-menu