The Agent Skills Directory

[METADATA_POISONING]: The skill package includes a file named sequence-alignment_audit_result_v2.json which contains detailed but simulated security and reliability audit metrics. The file explicitly claims "PASS" for categories such as security, scientific integrity, and code usability. This represents deceptive metadata meant to bypass security scrutiny by projecting a false image of third-party validation.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: scripts/main.py accepts query sequences (DNA or protein) via the --sequence CLI parameter.
Boundary markers: The instructions do not define strict boundaries or provide the agent with guidance to ignore instructions that could be embedded within sequence data.
Capability inventory: The skill scripts have the capability to perform network requests and write to the local file system.
Sanitization: The script does not sanitize the input sequence data before processing. Furthermore, the presence of the audit JSON file containing self-referential safety claims (e.g., "Verdict: PASS") is an injection vector targeting the analysis process.
[EXTERNAL_DOWNLOADS]: scripts/main.py initiates network requests to the official NCBI BLAST API endpoint (https://blast.ncbi.nlm.nih.gov/Blast.cgi). This targets a well-known and trusted scientific resource necessary for the skill's primary function. Additionally, SKILL.md identifies the source repository as a public GitHub project under the author's account (github.com/aipoch/medical-research-skills).
[DYNAMIC_EXECUTION]: SKILL.md includes instructions to use python -m py_compile for validating the scripts/main.py entry point. This is a standard utility for syntax verification and bytecode compilation, posing no inherent security risk in this context.

sequence-alignment