The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from multiple complex file formats, creating a potential surface for indirect prompt injection attacks where malicious instructions could be embedded in data files.
Ingestion points: The skill provides instructions for reading data from H5AD, Zarr, CSV, Excel, Loom, and MTX files using functions like ad.read_h5ad(), ad.read_zarr(), and various helpers in anndata.io across all reference documents.
Boundary markers: While references/io_operations.md includes a manual example for host validation, there are no global boundary markers or system-level instructions ensuring that the agent disregards natural language instructions embedded within the processed scientific data.
Capability inventory: The skill is granted Bash, Write, Edit, and Read tools. The provided Python snippets demonstrate the ability to write files (adata.write_h5ad()) and perform network operations.
Sanitization: The skill lacks automated sanitization or strict schema validation for the contents of the ingested matrices and metadata before they are incorporated into the agent's context.
[DATA_EXFILTRATION]: The skill includes code examples that perform network requests to domains outside of the standard whitelisted services, which could be misused for data exfiltration if the target URLs are replaced with malicious ones.
Evidence: references/io_operations.md contains code using urllib.request.urlretrieve to download files from https://example.org.
Evidence: references/io_operations.md demonstrates accessing remote data via fsspec.get_mapper using s3:// and https://example.com protocols.

anndata