The Agent Skills Directory

[DYNAMIC_EXECUTION]: PathML 3.0.5 library exhibits unsafe deserialization behaviors documented in the skill instructions. The TileDataset class dynamically evaluates the tile_shape attribute from HDF5 files as Python code, and EntityDataset uses unrestricted PyTorch object loading (weights_only=False). The skill actively warns against loading untrusted .h5path and .pt artifacts and provides safe, dependency-free CLI tools for planning and validation to avoid triggering these risks.
[EXTERNAL_DOWNLOADS]: The skill identifies classes that fetch models and datasets from external sources, including Hugging Face (mesmer.onnx), Warwick University (PanNuke dataset), and Zenodo (DeepFocus dataset). These network operations are gated by explicit user consent requirements and are disabled by default. The destinations are well-known hosting and academic platforms.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data formats, such as whole-slide image technical metadata, CSV manifests, and JSON spatial schemas. This represents an attack surface for indirect prompt injection. The bundled CLI scripts (slide_manifest.py, validate_spatial_schema.py) implement robust validation, including path boundary enforcement, size limits, and strict schema verification to mitigate risks from malicious data inputs.
[COMMAND_EXECUTION]: The skill facilitates the execution of local Python scripts for data management and quality control. These scripts include security controls such as rejecting URLs, preventing symlink traversal, and enforcing root directory boundaries for all file operations. The instructions also provide standard package installation commands for native library prerequisites.

pathml