The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted catalog data from an external source, creating an indirect prompt injection surface.
Ingestion points: The scripts/fetch_catalog.py script fetches third-party Markdown content from multiple endpoints at huggingscience.co.
Boundary markers: The script automatically prepends an UNTRUSTED_BANNER to all fetched content, clearly identifying the data as untrusted third-party information to prevent the agent from treating it as instructions.
Capability inventory: The skill uses standard libraries for networking and parsing but does not include any arbitrary shell execution or direct evaluation of fetched strings. Resource loading (e.g., via Transformers) is handled through separate, well-known libraries under explicit user guidance.
Sanitization: The script implements a _defang function that neutralizes potential markdown injection vectors by replacing code fences (```) and removing frontmatter separators (---) from the retrieved text.
[DYNAMIC_EXECUTION]: The skill documentation addresses the risks associated with dynamic code execution through external ML libraries.
Evidence: Reference documentation in SKILL.md and references/using-models.md provides explicit warnings about the trust_remote_code=True flag in the Transformers library. It advises users to verify repository contents, pin code revisions to specific hashes, and obtain authorization before executing custom remote code. This represents high-quality security documentation rather than a malicious pattern.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch its catalog and recommends downloading resources from established platforms.
Evidence: The script scripts/fetch_catalog.py performs GET requests to huggingscience.co, which is the vendor's own domain for this service. The instructions also involve downloading models and datasets from huggingface.co, which is recognized as a well-known service.

hugging-science