The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to run npx -y @nomadamas/k-skill@0 instruct market-kurly-search to fetch the primary instructions. This downloads and executes code from the @nomadamas scope on NPM.
[REMOTE_CODE_EXECUTION]: The use of npx -y for both instructions and reading disclaimer files (references/DISCLAIMER.md) constitutes remote code execution, as the CLI tool is fetched and executed at runtime.
[COMMAND_EXECUTION]: The skill requires the installation of the market-kurly-search NPM package (npm install market-kurly-search) and uses it within Javascript code blocks to perform searches and fetch product details.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external web surfaces (api.kurly.com and kurly.com/goods/). While it focuses on retail data like prices and availability, the ingestion of external HTML (__NEXT_DATA__) and API responses creates a surface where malicious instructions could theoretically be embedded, although the likelihood is low for this specific use case.
Ingestion points: API endpoints and product detail pages (instruction.md).
Boundary markers: None explicitly defined for the external data.
Capability inventory: No file-write or subprocess calls are shown in the provided snippets, but it relies on an external NPM library for network operations.
Sanitization: Not documented in the instructions; relies on the internal logic of the market-kurly-search package.

market-kurly-search