The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with official endpoints at api.fda.gov. This is a well-known, trusted government service. The interactions are limited to standard HTTPS GET requests for regulatory data.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the openFDA API (in scripts/fda_query.py). While this represents a data ingestion surface, the skill does not possess exploitable capabilities like shell command execution, eval(), or arbitrary file writes. Its actions are restricted to network requests to the FDA domain and writing to a local fda_cache directory, which mitigates the risk of malicious instructions in the API data influencing the system.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill follows best practices by instructing users to use environment variables (FDA_API_KEY) or placeholders for authentication.
[COMMAND_EXECUTION]: The skill does not perform any system command execution or subprocess spawning. All logic is implemented in native Python using the requests library.
[OBFUSCATION]: No obfuscated code, encoded payloads, or hidden URLs were detected across the skill files.

fda-database