The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx -y @nomadamas/k-skill@0 to dynamically retrieve instructions and execute helper functions. This pattern involves downloading and executing code from the npm registry. Since the package is within the author's namespace (@nomadamas), it is considered a vendor-owned resource.
Evidence: Found in SKILL.md and instruction.md.
[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/scholarship_filter.py, scripts/university_search_plan.py) to filter scholarship data and generate search queries. The test file scripts/test_scholarship_filter.py also uses subprocess.run() to invoke the filter script during automated testing.
Evidence: Referenced in instruction.md and scripts/test_scholarship_filter.py.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves searching and ingesting data from external scholarship announcements (e.g., kosaf.go.kr, university domains). This introduces an attack surface where malicious instructions hidden in public notices could attempt to influence the agent's output.
Ingestion points: External scholarship notice content and web search results (processed according to instruction.md).
Boundary markers: Absent. The instructions do not define specific delimiters to separate untrusted web data from the agent's operational instructions.
Capability inventory: Shell command execution via npx and local Python execution.
Sanitization: Absent. The skill does not explicitly describe sanitization or filtering of text extracted from web pages before processing.

korean-scholarship-search