The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from a personal GitHub account (Manali0711/Harvard-Artifacts-Collection-Data-Engineering-Analytics-App.git). This source is not identified as a trusted organization or a well-known service, posing a risk of executing unverified third-party code.
[COMMAND_EXECUTION]: The installation and execution process requires several shell commands, including git clone, pip install -r requirements.txt, and streamlit run app.py. These commands execute code retrieved from the external, unverified repository.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by ingesting data from an external source.
Ingestion points: Data is fetched from https://api.harvardartmuseums.org/object using the requests library in the extraction logic.
Boundary markers: The skill does not use delimiters or instructions to the agent to ignore potential malicious content embedded within the artifact metadata (e.g., titles, cultures, or descriptions).
Capability inventory: The skill uses mysql-connector-python for database operations, pandas for data manipulation, and streamlit for the front-end dashboard.
Sanitization: Basic data validation like fillna and pd.to_numeric is present, but it does not specifically sanitize against adversarial natural language instructions hidden in the API response.

harvard-art-museums-data-engineering