Should you install k-skill?
Start with an individual skill if Korean services are your reason for adding agent capabilities. The k-skill README covers transport, public records, shopping, finance, Korean writing and HWP documents. Selecting one task gives you a smaller set of instructions, dependencies and external services to inspect before expanding the installation. This is our recommendation; the project's default onboarding starts with the full collection and its setup skill.
The supplied current README lists 133 skills, while the README at our measured commit lists 125. Those are catalogue counts, not verified workflows or passing tests. Keep the current documentation separate from the snapshot used in our run.
What our sandbox established
Our run on October 2, 2026, at commit 9fade13 completed installation and build, but the test command returned exit 1.
Our harness records each command's success flag, exit code, elapsed time and timeout status. The attached summary records installation at 19 seconds, build at 8 seconds and tests at 8 seconds. Installation and build returned zero; tests returned 1. The build tail shows a workspace build using --if-present, so that result does not establish that every workspace had a build script or that a deployed CLI worked.
The immediate test failure was Python virtual-environment preparation: ensurepip was unavailable. The log recommends installing python3.11-venv and recreating the environment. This identifies the setup obstacle without predicting how the remaining tests would behave. Stored test counts are null, so there is no passing-test total to report and no basis for claiming exhaustive coverage.
The attached dependency figures are stored parser summaries: 160 packages and 91 MB. The raw installation tail reports a different added-package figure and a shorter elapsed time. Those outputs remain unreconciled; we retain the attached dated summary rather than replace it with the tail or treat it as an exhaustive inventory.
The environment also needs qualification. The sandbox image is labeled lab-node:22, but the raw npm warnings report Node v18.20.8 and dependencies requiring Node 20+. The image label alone cannot establish the runtime used by the commands.
The MrKeyoor testing methodology explains command-outcome reporting and its limits. The supplied October 31 version provides provenance context; it does not establish that this October 2 run used that later procedure. This correction uses the existing stored run. We did not verify live service workflows, authenticated actions or deployment.
What the audit tells you
Our stored npm audit result contains three high-severity advisories.
The attached result records zero critical, moderate and low advisories. These are recorded advisories, not verified exploit findings or proof of security. The record has no scannedPackages field, so scan coverage is unknown. We do not infer coverage from the installation log or the dependency summary.
Where lookup ends and action begins
KTX timetable lookup does not log in, reserve, join a reservation waitlist, pay or cancel.
The README describes this helper as a query of Korail's official planned timetable. Other catalogue entries have different boundaries: bus skills support booking, the registry helper assists with a cart and viewing after manual payment, and the payment-order assistant prepares information and a browser handoff after login. Read the selected skill's instructions before assuming it can finish the task named in the catalogue.
Check the available data as well as the action boundary. For example, the emergency-room entry describes operating flags and update times, while saying the public nearby listing does not expose exact remaining beds or utilization. A helper can retrieve the documented fields without answering the question you intended to ask.
Credentials can change the installation decision
The security and secrets guide distinguishes host-provisioned vault capabilities from generic environment-variable and dotenv fallbacks. The generic fallback file is plaintext, and the guide says generic agents can read and write it. Its file permissions protect against other local users; they do not hide its contents from the agent.
Several services use the default hosted proxy without requiring the user's upstream API key. That reduces credential setup for those routes and places an operator-managed service in the request path. Review the project's linked proxy privacy policy before sending sensitive input. We have not independently assessed that policy or the proxy's operation.
Which alternatives fit a different task?
Anthropic Skills provides examples for creative, technical, enterprise and document tasks.
The Anthropic Skills repository presents these as demonstration and educational material. It also distinguishes open-source examples from source-available document skills. Choose it to study skill design or document workflows. It can complement k-skill; the supplied source does not establish equivalent Korean service coverage.
Superpowers is a software-development methodology built from composable agent skills.
The Superpowers repository describes design, implementation planning, testing and review workflows. Choose it for the process around building software. Its documented role can complement service helpers, but does not establish a replacement for their Korean integrations.
How to read the ratings
These editorial ratings use a five-point rubric: 1 means a major obstacle to the intended task; 2 means substantial limitations; 3 means usable with material qualifications; 4 means strong documented support with bounded gaps; and 5 requires broad verification for the stated audience. Unknown dimensions receive no numerical rating. The scores are judgments, not benchmarks.
Setup ease is 3 because installation and build succeeded, while Python test preparation failed and runtime warnings remain unresolved. Documentation is 4 for Korean-speaking readers because the catalogue and secrets guide explain service boundaries and credential modes. Community is unassessed because the supplied evidence does not establish contributor breadth, response quality or adoption. Maturity is 3 because the measured snapshot built but lacks passing-test and live-workflow verification here.