The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users to manage their NVIDIA NGC API keys by sourcing a .env file and exporting NGC_API_KEY. This is documented as a standard security practice for local deployment and is used for authentication with official NVIDIA services.
Evidence found in SKILL.md and references/api.md regarding the use of [ -f .env ] && . ./.env to load credentials.
[COMMAND_EXECUTION]: The skill provides shell commands for environment setup, container registry authentication, and launching the NIM via Docker. These commands are necessary for the skill's primary purpose of deploying a local inference microservice.
Evidence includes docker login nvcr.io, docker run commands with NVIDIA runtime flags, and curl commands to fetch database metadata from api.ngc.nvidia.com.
[DYNAMIC_EXECUTION]: The setup workflow uses a Python script generated via shell heredoc to parse JSON metadata and generate input files for the aria2c downloader. This is a local utility function used to facilitate high-speed database downloads.
Evidence found in SKILL.md where a Python block parses /tmp/files.json to create /tmp/aria.in.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied protein sequences to generate multiple sequence alignments. This constitutes an attack surface for indirect prompt injection if the processed sequences were to contain malicious instructions, though the risk is mitigated by the scientific context and typical agent guardrails.
Ingestion points: Protein sequences provided via the sequence or sequences fields in request payloads, as documented in SKILL.md and references/api.md.
Boundary markers: None identified for the sequence data input.
Capability inventory: The skill uses Bash (for Docker/curl operations), Write (for saving alignment artifacts), and AskUserQuestion tools.
Sanitization: No specific sanitization or filtering of the protein sequence strings is mentioned prior to API submission.

msa-search-nim