The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a Python-based CLI wrapper (scripts/popbill_cli.py) to execute official Popbill SDK methods, facilitating business automation tasks like tax invoice issuance and messaging.
[DATA_EXPOSURE]: The implementation follows secure practices for secret management by reading credentials from a local configuration file (~/.config/k-skill/secrets.env) and explicitly enforcing 0600 (read/write by owner only) file permissions to prevent unauthorized access.
[DYNAMIC_EXECUTION]: While the skill instantiates SDK objects dynamically based on JSON input payloads, it mitigates risk by restricting these instantiations to a hardcoded whitelist of allowed classes defined in scripts/popbill_registry.py.
[EXTERNAL_DOWNLOADS]: The skill uses npx to retrieve instructions and execute logic from the @nomadamas organization on npm. This is the official namespace of the skill's author and is consistent with the intended delivery mechanism.
[SAFE]: A safety guard mechanism is implemented in scripts/popbill_safety.py that identifies potentially harmful methods (e.g., payments, deletions, message sending). The CLI requires an explicit --yes-i-understand flag and separate production confirmation flags to execute these operations, ensuring human-in-the-loop control.

popbill