The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents the use of ov.io.load(path) for loading Python objects, noting that it uses pickle/cloudpickle for deserialization. Pickle is inherently insecure because it can execute arbitrary code during the unpickling process. An attacker could craft a malicious pickle file that, when loaded by an agent following these instructions, executes commands on the underlying system. This is a significant risk if the agent is directed to process data from untrusted repositories or external sources.\n
Evidence: SKILL.md explicitly identifies ov.io.load(path) as "Pickle deserialization".\n
Evidence: reference.md demonstrates usage of ov.io.load to restore saved Python objects.\n- [PROMPT_INJECTION]: The skill teaches the agent to ingest a wide array of complex data formats (h5ad, 10x Genomics H5/MTX, Visium HD, Nanostring SMI) which serves as an entry point for indirect prompt injection. Malicious instructions could be hidden in metadata or data fields within these files to influence the agent's behavior.\n
Ingestion points: Multiple functions such as ov.read(), ov.io.read_h5ad(), ov.io.read_10x_h5(), ov.io.read_10x_mtx(), ov.io.spatial.read_visium(), ov.io.read_visium_hd(), and ov.io.read_nanostring() in SKILL.md and reference.md.\n
Boundary markers: The instructions lack any mention of using boundary markers or specific "ignore instructions" delimiters to protect against embedded commands in the ingested data.\n
Capability inventory: The agent uses these tools to load data into memory (AnnData/DataFrames) which are then used in analytical workflows, potentially affecting downstream decisions.\n
Sanitization: No sanitization or validation steps for the content of the biological data files are provided in the skill instructions.

data-io-loading