The Agent Skills Directory

Generic Network Request Capability: The rest_request.py script serves as a general-purpose HTTP client. Although the instructions suggest using it for the EpiGraphDB API, the script's input schema allows for the specification of arbitrary base_url, method, and headers. This flexibility could potentially be used to interact with unauthorized internal or external services if the agent deviates from its prescribed instructions.
Unrestricted Local File Write: The skill includes a save_raw feature that writes API responses to a local file path provided via the raw_output_path parameter. The script does not perform path sanitization or directory traversal checks, which could allow for writing data to sensitive locations, such as configuration files, if an absolute path is provided in the tool call.
Indirect Prompt Injection Surface: The skill ingests and processes data from an external API (EpiGraphDB). Since this data is summarized and presented within the agent's context, it presents a surface for indirect prompt injection where instructions embedded in the API response could potentially influence the agent's behavior.
Capability Inventory for Ingestion Points (Category 8):
Ingestion points: Data retrieved from external API endpoints via scripts/rest_request.py.
Boundary markers: Absent; data is directly summarized and returned to the agent context.
Capability inventory: The script has the ability to make network requests (requests.request) and write to the local filesystem (Path.write_text).
Sanitization: The script performs structural truncation (limiting list lengths and string sizes) but does not sanitize the content of strings for potential instructions.

epigraphdb-skill