The Agent Skills Directory

Arbitrary File Access: The scripts/sparql_request.py script allows reading the content of local files through the query_path input field. The implementation uses Path(query_path).read_text() without restricting the directory or validating the file type, which could lead to the unintended reading of sensitive system or configuration files.
Unrestricted File Writing: The skill enables writing the results of network requests to arbitrary locations on the file system using the raw_output_path and save_raw parameters. The script uses path.write_text() to save the content of the response from the SPARQL endpoint to the provided path. This could potentially allow overwriting existing files or placing data in sensitive directories.
Data Exfiltration Surface: Content read from local files via query_path is sent as a query parameter to an external endpoint (https://www.bgee.org/sparql/). While this endpoint is a well-known service, the pattern of reading local data and transmitting it externally represents a data exposure risk.
Indirect Prompt Injection Surface: The skill processes and summarizes data retrieved from an external SPARQL endpoint. 1. Ingestion points: Data enters the agent context via the execute function in scripts/sparql_request.py after parsing the JSON response from the Bgee endpoint. 2. Boundary markers: The skill does not use specific delimiters or instructions to ignore potential commands embedded in the retrieved biological data. 3. Capability inventory: The skill possesses network access capabilities and file system read/write permissions. 4. Sanitization: There is no evidence of sanitization or filtering of the external content before it is summarized for the user, which could allow malicious instructions embedded in data to influence the agent's behavior.

bgee-skill