The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents several interfaces for ingesting untrusted data from external and remote sources, which could serve as an attack surface for indirect prompt injection if the data contains malicious instructions targeted at the agent.
Ingestion points: The skill uses astropy.io.fits.open for FITS files (including S3/HTTP URIs), astropy.table.Table.read for various catalog formats (CSV, HDF5, VOTable), and astropy.utils.data.download_file for generic remote file retrieval as seen in references/fits.md, references/tables.md, and references/wcs_and_other_modules.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between data content (like FITS header keywords) and instructions.
Capability inventory: The skill environment includes Bash(uv:*) and Bash(python:*) tools, which the agent uses to execute code that processes this external data. It also possesses Read, Write, and Edit permissions.
Sanitization: There is no evidence of sanitization or validation logic to filter potentially malicious strings within the processed data metadata or table contents.
[EXTERNAL_DOWNLOADS]: The skill facilitates and documents network operations to retrieve scientific data and metadata.
SkyCoord.from_name and EarthLocation.of_address perform queries to online astronomical databases (e.g., SIMBAD).
astropy.io.fits.open supports reading data directly from cloud storage (S3) and HTTP servers.
astropy.time may automatically download IERS (International Earth Rotation and Reference Systems Service) data to maintain precision in time conversions.
astropy.samp (Simple Application Messaging Protocol) is documented for inter-process communication with other astronomical software, involving local network messaging.

alterlab-astropy