The Agent Skills Directory

File System Access: The scripts/rest_request.py script includes a save_raw function that writes data to a file path provided in the input (raw_output_path).
Potential Concern: If the execution environment does not enforce directory restrictions, this capability could be used to write data to unintended locations or overwrite sensitive system files.
Context: This functionality is provided to allow users to save raw API response data for further processing or debugging.
Generic Network Request Surface: The skill provides a generic REST client that can be directed to any URL and configured with arbitrary headers and request bodies.
Potential Concern: While documented for use with the eQTL Catalogue API, the underlying script lacks domain restrictions, which could allow it to be directed toward other internal or external endpoints.
Context: The skill is designed to interact with public scientific APIs at the European Bioinformatics Institute.
Indirect Prompt Injection Surface: The skill ingests data from external APIs and processes it for presentation to the agent.
Ingestion points: The skill fetches response data from remote URLs in scripts/rest_request.py using the requests library.
Boundary markers: The instructions do not include specific delimiters or instructions for the agent to ignore potentially malicious content embedded in the API responses.
Capability inventory: The skill has both network communication and file-writing capabilities.
Sanitization: The data undergoes structural compaction and truncation for readability, but the content is not sanitized for potential instructional patterns.

eqtl-catalogue-skill