The Agent Skills Directory

[SAFE]: The skill provides comprehensive guides and offline helper scripts (entry_operations.py, notebook_operations.py, setup_config.py) that do not perform network requests or persist credentials, ensuring a secure-by-default environment.
[COMMAND_EXECUTION]: The bundled scripts are designed to be run locally via uv for signature generation and archive inspection. These scripts use standard library modules and include internal validation logic to prevent common command and file-path injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill identifies the attack surface associated with processing external data from LabArchives (XML, JSON, ZIP containers). It mitigates this risk by instructing the agent to treat all returned content as untrusted data and explicitly warns against executing instructions found within notebook entries.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests fetching citation metadata from arxiv.org, a well-known and trusted academic repository. This operation is documented for transparency and targets a reputable service.
[DYNAMIC_EXECUTION]: The notebook_operations.py script includes manual checks to prevent XML External Entity (XXE) attacks by rejecting DTD and entity declarations before parsing manifest files.

labarchive-integration