The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to run npx -y @nomadamas/k-skill@0 to fetch instructions and perform updates. This involves downloading and executing a package from the npm registry.
[COMMAND_EXECUTION]: The skill relies on the execution of shell commands (npx, curl) and a Python script (scripts/run_mofa_travel_safety.py) to perform its primary functions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the South Korean Ministry of Foreign Affairs API via a proxy. This data includes a remark field containing free-text descriptions, which represents a potential attack surface for indirect prompt injection if the source content is compromised.
Ingestion points: The API response is parsed in scripts/run_mofa_travel_safety.py and displayed by the agent as instructed in instruction.md.
Boundary markers: While the instructions emphasize factual reporting and using official field names, they do not specify clear delimiters (e.g., XML tags or triple backticks) to isolate the external content from the agent's instructions.
Capability inventory: The skill has the ability to perform network requests and execute local Python code.
Sanitization: There is no evidence of content filtering or sanitization performed on the remark or region_ty fields before they are summarized for the user.

mofa-travel-safety