The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses allowed-tools to run Bash and Python commands. This is primarily used for running the bundled scripts/query_datagov.py script to interact with the CKAN API and for one-liner data processing tasks.
[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md include a command that pipes the output of a curl request from a government API (data.gov.il) to a Python one-liner (python3 -c). The Python code is a hardcoded string provided within the instructions intended for JSON parsing and does not execute content provided by the remote server. This is evaluated as a safe data-processing pattern.
[EXTERNAL_DOWNLOADS]: The skill interacts with the official Israeli government data portal API at data.gov.il. It also references recommended MCP servers hosted at agentskills.co.il, which is a vendor resource associated with the skill's author (skills-il). These are well-known and legitimate services for the skill's stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it retrieves data from external public datasets.
Ingestion points: External data is retrieved from data.gov.il CKAN API endpoints via SKILL.md instructions and the scripts/query_datagov.py script.
Boundary markers: Absent. There are no specific delimiters or instructions to ignore embedded commands when processing retrieved data.
Capability inventory: The skill has access to shell execution, network fetching, and Python scripting.
Sanitization: The skill focuses on data retrieval and summarization but lacks explicit filtering or sanitization of the content fetched from the public datasets.

israel-gov-api