The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to run npx -y @nomadamas/k-skill@0 to fetch instructions and legal documentation. This targets the author's official CLI package on the public npm registry. Since '@nomadamas' is the identified vendor for this skill, this is considered standard vendor functionality and not a security risk.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill requires TOSSINVEST_CLIENT_ID and TOSSINVEST_CLIENT_SECRET environment variables. The instructions explicitly mandate that these credentials stay within the user's environment, are sent directly to the official API origin (https://openapi.tossinvest.com), and are masked in error logs. No evidence of credentials being sent to unauthorized third parties was found.
[COMMAND_EXECUTION]: The skill documentation includes examples of running npx commands. These are used for documentation retrieval and instruction generation, which is a common pattern for k-skill stubs and does not involve arbitrary command execution of untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests financial data from the official Toss API. While this is a data ingestion surface, the skill is scoped to read-only operations and includes instructions to mask sensitive information and follow strict output boundaries, minimizing the risk of prompt injection from the API responses.

toss-investment