The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted scientific data (CSV, JSON, HDF5, FASTA/FASTQ, images) which creates an indirect prompt injection surface. The risk is mitigated through a multi-layered defense:
Ingestion points: Data enters the environment via the scripts/ directory utilities (e.g., eda_analyzer.py, tabular_profile.py) which perform bounded scanning.
Boundary markers: Explicit instructions in SKILL.md direct the agent to treat all file content as untrusted data. Output is provided in structured JSON or sanitized Markdown.
Capability inventory: All bundled scripts are local-only and perform no network operations. File access is restricted to an authorized root directory with strict validation against symlinks and traversal.
Sanitization: Identifiers and metadata are redacted via BLAKE2s hashing (stable_token) or sanitized (markdown_scalar) before reporting.
[SAFE]: The skill enforces least-privilege I/O. For example, _common.py implements atomic_write_bytes which sets file permissions to 0600 (private) and ensures atomic operations in the same directory.
[SAFE]: Dependency management is restricted to pinned versions of well-known scientific libraries (NumPy, pandas, Polars, h5py, Biopython, Pillow, tifffile). These are standard packages from trusted ecosystems.
[SAFE]: No malicious patterns such as code obfuscation, persistence mechanisms, privilege escalation, or unexpected network exfiltration were detected. The skill includes content signature verification (validate_magic) to prevent format-spoofing attacks.

exploratory-data-analysis