The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's instructions require the execution of npx commands that download and run a vendor-owned package from the public npm registry for retrieving instructions and performing updates.
Evidence: SKILL.md contains npx -y @nomadamas/k-skill@0 instruct kstartup-search, npx -y @nomadamas/k-skill@0 update, and execution commands.
[EXTERNAL_DOWNLOADS]: The skill downloads tools and configuration from the npm registry and references documentation hosted on GitHub.
Evidence: References to npmjs.com and github.com/NomaDamas for instructions and tool updates.
[COMMAND_EXECUTION]: The skill executes a local Python helper script (scripts/run_kstartup.py) to interact with external APIs.
Evidence: SKILL.md and instruction.md describe executing the Python script via a vendor-provided CLI wrapper.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the external K-Startup Open API, which presents a surface for indirect prompt injection if the upstream data contains malicious instructions.
Ingestion points: scripts/run_kstartup.py fetches data from the K-Startup API endpoints via urllib.request.urlopen.
Boundary markers: Absent; the helper script outputs raw JSON or plain-text summaries without explicit delimiters or injection warnings.
Capability inventory: The skill has network access for API calls and file system access to read local secrets (~/.config/k-skill/secrets.env).
Sanitization: Absent; the script filters and normalizes data for display but does not sanitize the content against prompt injection attacks.

kstartup-search