The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external genomics data (H5, Parquet, CSV) and incorporates extracted metadata, such as sample names and gene names, into a generated HTML report. This creates a surface for indirect prompt injection or potential cross-site scripting (XSS) if the report is viewed in a browser.
Ingestion points: scripts/main.py reads data via scanpy.read_visium, scanpy.read_10x_h5, pyarrow.parquet.read_table, and pandas.read_csv.
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded content in processed data.
Capability inventory: scripts/main.py writes PNG images and HTML reports to the local file system.
Sanitization: Absent. The generate_report method in scripts/main.py uses f-strings to construct the HTML document without escaping or validating the input variables interpolated into the template.
[EXTERNAL_DOWNLOADS]: The skill specifies several unversioned Python dependencies in requirements.txt, which is a best practice violation that can lead to supply chain risks.
The requirement pil refers to the legacy Python Imaging Library, which has been superseded by Pillow. Specifying the legacy name or leaving it unversioned can lead to the installation of outdated or unexpected packages.

spatial-transcriptomics-mapper