The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a large attack surface for indirect prompt injection by processing complex biological data formats and external API results.
Ingestion points: Untrusted data enters the agent context through several entry points: SeqIO.parse for biological sequence files (e.g., FASTA, GenBank) in references/sequence_io.md; Entrez.read and Entrez.efetch for NCBI database records in references/databases.md; NCBIXML.read for BLAST search results in references/blast.md; and PDBParser for protein structure files in references/structure.md.
Boundary markers: The instructions lack explicit boundary markers or system-level warnings to the agent regarding the potential for malicious instructions hidden within biological data (such as sequence comments, record metadata, or publication abstracts).
Capability inventory: The skill possesses significant capabilities that could be targeted by an injection, including execution of external bioinformatics tools via subprocess wrappers (ClustalOmegaCommandline, MuscleCommandline, NcbiblastnCommandline), network operations to NCBI domains, and file system write operations (SeqIO.write, PDBIO.save, Phylo.write).
Sanitization: There is no mention of sanitization or strict schema validation for the contents of processed files or API responses before they are used to drive subsequent tool operations.

biopython