The Agent Skills Directory

[SAFE]: The skill implements a legitimate workflow for pharmaceutical research and drug discovery. The author, Harvard MIMS, uses standard academic and industry patterns for identifier resolution and bioactivity mining.
[DATA_EXPOSURE]: The skill explicitly advises using environment variables (os.environ.get("NVIDIA_API_KEY")) for sensitive credentials, which is a secure practice. No hardcoded secrets were found in the instructions or examples.
[REMOTE_CODE_EXECUTION]: External data retrieval is performed using the requests library targeting well-known scientific domains such as pubchem.ncbi.nlm.nih.gov and ebi.ac.uk. These services are recognized as trusted, well-known providers in the bioinformatics domain.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests data from external APIs (ChEMBL, PubChem) and interpolates it into reports, the risk of injection is mitigated by the structured nature of the data and the intended scientific use case. No evidence of malicious exploitation of this attack surface was found.
[EXTERNAL_DOWNLOADS]: All external downloads (SDF files, PDB structures, bioactivity JSON) originate from authoritative sources like NCBI and EBI, or the trusted vendor NVIDIA. These are documented neutrally as required for well-known services.
[COMMAND_EXECUTION]: The skill uses internal tu.tools and standard Python libraries for data processing. There is no usage of dangerous system commands or unauthorized subprocess execution.

tooluniverse-binder-discovery