The Agent Skills Directory

[External API Communication]: The skill interacts with reputable bioinformatics services including the FinnGen PheWAS API (r12.finngen.fi) and Ensembl REST APIs (rest.ensembl.org). These communications are performed over HTTPS with proper timeout configurations and are limited to the skill's primary purpose of genetic data retrieval.
[Input Validation and Sanitization]: The skill implements thorough validation for genomic coordinates and rsID formats. It uses regular expressions to ensure chromosome names and alleles follow standard biological nomenclature, reducing the risk of processing malformed or unexpected data.
[Controlled File Operations]: The skill includes a feature to save raw association data to a local file. This is implemented with security in mind, using a predefined safe character filter for filenames and defaulting to the /tmp directory, which follows the principle of least privilege for temporary data storage.
[Indirect Prompt Injection Surface]: Like any skill that processes external API data, there is a theoretical surface for indirect prompt injection if an API were to return malicious instructions. However, the skill treats API output as data to be summarized into markdown rather than instructions to be executed, and the developer-vendor context for this skill ('openai') suggests a high standard of safety in the tool's intended deployment environment.

finngen-phewas-skill