The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains multiple instructions to install anndata==0.12.16 using uv pip install. As of late 2024, the stable release cycle for anndata is in the 0.11.x range. The skill claims this version was released in May 2026, making it a futuristic and unverifiable dependency. Installing specific unreleased versions from public registries is a known vector for dependency hijacking.
[COMMAND_EXECUTION]: The skill frequently uses the uv tool to execute shell commands for environment management and package installation. This reliance on shell-level operations increases the risk of command injection if parameters like package versions or paths are compromised.
[METADATA_POISONING]: There is a mismatch between the provided author context ('kinandigital') and the metadata field in SKILL.md ('K-Dense Inc.'). While not an direct attack, this inconsistency can be used to mask the true origin of the skill.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill provides extensive methods for reading external data from H5AD, Zarr, CSV, MTX, Loom, and Excel files via ad.read_h5ad, ad.read_zarr, and various anndata.io helpers.
Boundary markers: The instructions lack explicit boundary markers or system instructions to ignore potential natural language commands embedded within the data matrices or metadata.
Capability inventory: The agent is granted Bash, Write, and Edit tools, which could be leveraged by a malicious payload embedded in a scientific dataset to perform unauthorized file or network operations.
Sanitization: There is no evidence of data validation or sanitization for the content of processed files, although a basic HTTPS/host check is shown as a template for remote downloads in references/io_operations.md.

anndata