The Agent Skills Directory

[SAFE]: No security issues detected.
[COMMAND_EXECUTION]: Uses standard system utilities like curl, jq, git, dd, and stat for API interaction and file management. These operations are consistent with the skill's primary purpose.
[EXTERNAL_DOWNLOADS]: Downloads research data from Figshare's official API (api.figshare.com) and performs update checks against the vendor's repository. These are legitimate operations for a data management skill.
[CREDENTIALS_UNSAFE]: Appropriately handles authentication by instructing users to export their Figshare token as an environment variable (FIGSHARE_TOKEN), rather than hardcoding it.
[INDIRECT_PROMPT_INJECTION]: Ingests metadata and file lists from the Figshare API. While this presents a standard data ingestion surface, the skill includes instructions to confirm actions with the user before performing destructive or permanent operations.

figshare-skill