The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the installation of its native components via standard package managers (pip and cargo) using pinned versions. It also includes several helper scripts in the scripts/ directory, such as bed_validator.py and artifact_inspector.py, which facilitate local data inspection and hashing without executing third-party code.- [EXTERNAL_DOWNLOADS]: Capabilities for remote data access, such as Tokenizer.from_pretrained (connecting to Hugging Face) and RefgetStore.open_remote (connecting to genomic repositories), are explicitly documented with security warnings. The skill mandates explicit user approval for specific endpoints and provides mechanisms to prioritize local snapshots over remote fetching.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted genomic data files (BED, FASTA). To address this, it includes dedicated validation tools like scripts/bed_validator.py and scripts/tokenizer_manifest.py. These scripts implement a defense-in-depth strategy by checking coordinate bounds, rejecting NUL bytes, preventing path traversal (..), and blocking symlink usage.- [DATA_EXFILTRATION]: The skill author acknowledges the privacy risks of genomic coordinates and barcodes. The bundled local report tools are designed to be privacy-preserving, redacting local file paths and emitting only high-level summary statistics to prevent accidental leakage of sensitive identifiers.

gtars