The Agent Skills Directory

[Network Request Capabilities]: The skill uses scripts/rest_request.py to make network requests using the requests library. While configured by default for the CELLxGENE API, the generic nature of the script allows it to target any URL provided in its input, including bypassing the base_url if a full URL is provided in the path parameter.
[File System Interaction]: The script includes functionality to save raw response data to the local filesystem. While it defaults to a /tmp/ directory, the raw_output_path parameter permits writing to arbitrary file paths accessible to the execution environment, which is a potential persistence or data overwrite risk if misused.
[Indirect Prompt Injection Surface]: The skill processes JSON input from the agent to determine request targets and file storage locations. If the agent populates these fields based on untrusted external content without additional sanitization, it could be influenced to perform unintended actions.
Ingestion points: sys.stdin in scripts/rest_request.py receives the JSON payload.
Boundary markers: None present; the skill relies on standard JSON structure for data isolation.
Capability inventory: The skill can perform HTTP GET and POST requests and write text files to the local disk.
Sanitization: The script performs type validation (ensuring inputs are strings, integers, or booleans) but does not restrict the content of URLs or file paths beyond basic type checking.

cellxgene-skill