The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous Python and Bash examples that execute system utilities such as curl, wget, aria2c, gunzip, and specialized scientific software like obabel, dock6, and vina via subprocess.run.
[DYNAMIC_EXECUTION]: The skill generates and executes scripts at runtime to process chemical data, perform property filtering, and prepare molecules for simulation.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill retrieves large volumes of chemical data (SMILES, identifiers, and molecular properties) from the external ZINC API (cartblanche22.docking.org) and file repositories (files.docking.org).
Boundary markers: There are no explicit instructions or delimiters to prevent the agent from misinterpreting data returned by the API as instructions, especially when results are parsed and stored in variables used in subsequent prompt steps.
Capability inventory: The skill environment possesses high-privilege capabilities including network access (curl/wget) and the ability to execute arbitrary binaries through subprocess.run.
Sanitization: The provided Python integration scripts lack validation for inputs such as zinc_id or smiles before interpolating them into command-line arguments, which could allow for argument injection (e.g., passing malicious flags to curl).

zinc-database