The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the author's utility package (@nomadamas/k-skill) for managing skill instructions and performing updates. These resources are provided by the skill vendor and are essential for its operation.\n- [DATA_EXFILTRATION]: API credentials are managed using environment variables or a local configuration file (~/.config/k-skill/secrets.env). The skill correctly enforces 0600 file permissions to ensure that sensitive keys are only accessible by the owner.\n- [DYNAMIC_EXECUTION]: The CLI utility dynamically creates SDK objects from JSON input based on a __kind__ property. Security is maintained by validating these identifiers against a hardcoded registry of approved service and object classes, preventing arbitrary class instantiation.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Popbill APIs, such as invoice details or message contents, which may contain user-controlled data. This data is incorporated into the agent's context without sanitization or boundary markers.
Ingestion points: API responses in scripts/popbill_cli.py.
Boundary markers: Absent.
Capability inventory: API network calls and file access.
Sanitization: Absent.

popbill