The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes spacy.load() with a model identifier or path sourced from a configuration file (config.yaml). Because loading a spaCy model involves importing a Python package or directory, a malicious actor who can influence the configuration or file system could execute arbitrary code by pointing the skill to a crafted model directory. Evidence: scripts/main.py lines 145-146: model_name = self.config.get("ner_model", "en_core_web_sm") and self.nlp = spacy.load(model_name).- [INDIRECT_PROMPT_INJECTION]: The skill processes unstructured medical text from external clinical databases and raw text inputs. This ingestion of untrusted data without sanitization creates a vulnerability where adversarial content within medical records could be used to manipulate agent behavior when the output is later processed by a large language model. Ingestion points: scripts/main.py functions load_notes and extract_insights. Boundary markers: The skill does not implement delimiters or explicit instructions to distinguish between the medical data and agent instructions. Capability inventory: The skill has capabilities to read from and write to the file system (pandas, json). Sanitization: There is no evidence of sanitization or filtering applied to the source clinical text.- [DATA_EXFILTRATION]: The load_notes function accepts a file path directly from user input or configuration without validating it against directory traversal attacks. This could allow an attacker to read sensitive files outside the intended workspace if they can provide a path like ../../etc/passwd that happens to have a supported extension. Evidence: scripts/main.py lines 157-175: path = Path(notes_path) is used in pd.read_csv(path) and pd.read_parquet(path) without checking if the path is within the allowed directory.- [METADATA_POISONING]: The skill package includes an audit result file that presents extensive claims regarding the skill's safety and production readiness. Such self-authoritative safety claims can deceive users into bypassing standard security verification protocols. Evidence: unstructured-medical-text-miner_audit_result_v2.json contains assertions such as "security": "PASS" and "deployable": true.

unstructured-medical-text-miner