The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill and the underlying 'matchms' library explicitly support and encourage the use of Python's 'pickle' format for fast loading and saving of processed spectra (e.g., load_from_pickle, save_as_pickle). Deserializing data using the 'pickle' module is inherently unsafe as it can be exploited to execute arbitrary code. An attacker could provide a malicious .pkl file that, when loaded by the agent, compromises the host environment.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch data from external sources during processing. Specifically, derive_annotation_from_compound_name retrieves chemical information from PubChem (NIH), and load_from_usi fetches spectral data from online metabolomics repositories using Universal Spectrum Identifiers. While these target well-known scientific services, they involve automated external network requests triggered by input data.
[COMMAND_EXECUTION]: The installation instructions recommend using uv pip install, which involves executing system-level commands to manage dependencies. While standard for library setup, it requires appropriate environment permissions.

matchms