The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external data (catalog metadata and CSV rows) from the data.gouv.fr platform, which constitutes an indirect prompt injection surface. This is a standard risk for data-ingestion skills and is mitigated by the use of an official, authoritative source.\n
Ingestion points: Catalog metadata from GET /datasets/, tabular data rows from GET /api/resources/{rid}/data/, and external API documentation via machine_documentation_url.\n
Boundary markers: Absent. The instructions do not define specific prompt delimiters for the ingested data.\n
Capability inventory: HTTP methods (GET, POST, PUT, DELETE) for platform interaction via documented endpoints.\n
Sanitization: Not explicitly defined within the skill instructions for the retrieved data content.\n- [DATA_EXFILTRATION]: No unauthorized exfiltration patterns detected. The skill specifically instructs the agent to never log or echo the X-API-KEY and limits network activity to official government domains (data.gouv.fr, gouv.fr).\n- [REMOTE_CODE_EXECUTION]: No remote code execution vulnerabilities. The provided Python examples use the standard requests library for API interactions and do not involve untrusted code execution.\n- [CREDENTIALS_UNSAFE]: No hardcoded secrets. The skill provides correct guidance for the secure use of API keys provided by the user.

datagouv-apis