The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install an external MCP server using uvx khanoumi-mcp. This package is hosted on a public registry and is not provided by a recognized trusted organization or the verified vendor, potentially leading to the execution of unvetted code.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display untrusted data from the Khanoumi website.
Ingestion points: Untrusted product data and customer reviews are fetched from khanoumi.com via the kh_search and kh_reviews tools (SKILL.md).
Boundary markers: The skill lacks explicit instructions or delimiters to isolate fetched content from the agent's core instructions.
Capability inventory: The tools are restricted to read-only search and retrieval operations, which limits the potential impact.
Sanitization: No sanitization or validation of the external content is performed before it is processed by the agent.

khanoumi