The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection because it processes external molecular data formats that may contain embedded instructions.
Ingestion points: The agent reads potentially untrusted data through functions like dm.read_sdf, dm.read_csv, dm.read_excel, and dm.open_df in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potential natural language commands within the processed data files.
Capability inventory: The skill possesses file-writing capabilities (dm.to_sdf, dm.to_xlsx) and network access through remote storage backends, which could be abused if an injection occurs.
Sanitization: While the datamol library performs chemical sanitization (validating molecular structures), it does not sanitize or filter for natural language instructions in data metadata.
[DATA_EXFILTRATION]: The skill facilitates network operations and remote data transfers through its integration with fsspec.
As documented in SKILL.md, the skill supports reading from and writing to remote storage protocols including S3, GCS, and HTTP.
This capability allows for the potential exfiltration of processed data or environment information to external, non-whitelisted domains if misused.
[COMMAND_EXECUTION]: The skill utilizes parallel processing which involves the management of subprocesses.
Multiple batch processing functions, such as dm.descriptors.batch_compute_many_descriptors and dm.cluster_mols, use the n_jobs parameter to execute tasks across multiple CPU cores, representing a standard but relevant execution surface.

datamol-cheminformatics