The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the retrieval of data from dozens of external public APIs. Since this data is generated by third parties, it represents a surface for indirect prompt injection if malicious instructions are embedded in database records (e.g., protein descriptions, clinical notes, or patent text).
Ingestion points: API endpoints defined across 80+ reference files in the references/ directory.
Boundary markers: The skill includes strong mitigation instructions in SKILL.md (Core Workflow step 6) and references/retrieval-contract.md explicitly telling the agent to ignore instructions in payloads and sanitize data.
Capability inventory: The skill uses Read and Bash tools to fetch and process data.
Sanitization: The instructions mandate that the agent must sanitize or summarize response fields before using them in follow-up tool calls.
[DYNAMIC_EXECUTION]: For specific databases that do not support REST (such as the BRENDA enzyme database), the skill instructs the agent to write and execute a local Python script.
Evidence: references/brenda.md requires the use of the zeep library and states that 'making calls requires writing and executing a Python script... Use Bash to run the script'. This is a legitimate requirement for SOAP APIs but involves the dynamic generation of executable code.

database-lookup