The Agent Skills Directory

File System Interaction (Arbitrary File Write): The scripts/rest_request.py script includes functionality to save network response data to a local file. The raw_output_path parameter enables the agent to define the destination, and the script will create the necessary parent directories and write the content. This capability could potentially be used to write or overwrite files in sensitive locations, such as configuration or startup directories, if the tool's parameters are not constrained.
Network Interaction: The skill performs network requests to external services. While the instructions focus on the cBioPortal API, the script's design allows for dynamic base URLs and paths, enabling requests to any accessible network endpoint. This is a common requirement for REST tools but requires monitoring of the destinations accessed.
Indirect Prompt Injection Surface: The skill fetches data from remote sources and processes it for the agent, creating a vector for indirect prompt injection where malicious instructions in API responses could attempt to influence behavior.
Ingestion points: Data is fetched from remote API endpoints in scripts/rest_request.py using the requests library.
Boundary markers: None identified; the skill processes and compacts the raw API response but does not utilize specific delimiters to isolate the content from the agent's instructions.
Capability inventory: The skill has capabilities for network requests (requests), directory creation (path.parent.mkdir), and file writing (path.write_text).
Sanitization: The script includes a _compact function which helps manage payload size by truncating strings and limiting item counts, but it does not perform sanitization aimed at preventing prompt injection.

cbioportal-skill