The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (MEDIUM): The skill documentation includes the command npx domaindetails. This command downloads and executes code from the npm registry at runtime. Because the package author and the repository are not within the defined list of trusted organizations, this represents an unverifiable dependency and remote code execution risk.
[EXTERNAL_DOWNLOADS] (LOW): The skill uses curl to fetch data from mcp.domaindetails.com and api.domaindetails.com. While these requests are necessary for the skill's functionality, they target non-whitelisted external domains.
[DATA_EXFILTRATION] (SAFE): The skill transmits domain names to the domaindetails.com API. This is the intended behavior for a lookup tool and does not appear to access sensitive local files, credentials, or environment variables.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill ingests data from external API outputs (WHOIS/RDAP records). This presents a surface for indirect prompt injection if an attacker controls the domain records, though the impact is limited by the agent's processing logic.
Ingestion points: mcp.domaindetails.com/lookup/ and api.domaindetails.com/api/marketplace/search.
Boundary markers: None detected in the provided documentation.
Capability inventory: curl (network), jq (JSON processing), npx (code execution).
Sanitization: No explicit sanitization of API responses is mentioned.

domaindetails