The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to run npx, which downloads the @nomadamas/k-skill package from the npm registry. It also references external instruction files hosted on the vendor's GitHub repository at github.com/NomaDamas/k-skill.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx -y @nomadamas/k-skill@0 to execute remote package logic. This is used to print context-aware instructions and list bundled files at runtime.
[COMMAND_EXECUTION]: The workflow involves executing shell commands, specifically curl, to interact with the KOPIS API through the vendor's proxy server (k-skill-proxy.nomadamas.org).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the KOPIS API, which could theoretically contain malicious instructions.
Ingestion points: XML/JSON responses from k-skill-proxy.nomadamas.org via curl in instruction.md.
Boundary markers: None are explicitly defined to separate untrusted API data from agent instructions.
Capability inventory: The skill has the capability to execute shell commands (curl, npx).
Sanitization: No explicit sanitization or validation of the upstream API response is documented.

kopis-performance-search