The Agent Skills Directory

Broad Network Communication Surface: The scripts/rest_request.py script functions as a general-purpose REST client. Although the skill instructions specify the Human Metabolome Database (HMDB), the underlying script is capable of making network requests to any URL provided in its configuration. This versatility is a security consideration as it provides a broad interface for network interactions.\n- Unvalidated File System Writes: The script includes a save_raw feature that writes API responses directly to the file system. Because the script accepts a user-defined raw_output_path without restrictive validation, it presents a potential consideration for ensuring that data is only written to authorized and intended directories.\n- Indirect Prompt Injection Surface: The skill processes information from external API responses and integrates it into the agent's context. This establishes a potential surface for indirect prompt injection, particularly because the skill also has the capability to perform further network and file system operations.\n
Ingestion points: Data is fetched from external APIs using the requests library within scripts/rest_request.py.\n
Boundary markers: The skill does not employ explicit delimiters or specialized instructions to isolate external data from the agent's operating instructions.\n
Capability inventory: The script is capable of performing arbitrary network requests and writing text files to the local file system.\n
Sanitization: While the output is truncated to fit context limits, the script does not sanitize or filter the content of the API response for potentially risky patterns.

hmdb-skill