The Agent Skills Directory

Arbitrary File Write Capability: The scripts/rest_request.py script includes a save_raw feature that utilizes a raw_output_path parameter. This functionality allows the agent to write the results of network requests to any local file path it has permissions for, which could potentially be used to modify configuration files or other sensitive local resources.
Flexible Network Request Configuration: While the skill is designed for ProteomeXchange, the _build_url logic in the Python script allows the path parameter to act as a full URL, bypassing the intended base_url. This enables the tool to make GET or POST requests to any external domain, providing a general-purpose network access point.
Potential for Indirect Prompt Injection: The skill ingests data from external API endpoints (ProteomeXchange) and processes it for display to the user. As the skill lacks explicit boundary markers or sanitization for this external data, it could be susceptible to indirect prompt injection if an external source returns instructions designed to influence the agent's subsequent actions.
Configurable Request Headers: The tool allows for arbitrary headers to be passed in the input JSON. While useful for legitimate API interactions, this provides a mechanism for passing sensitive tokens or credentials that might be exposed if the tool is directed toward an untrusted endpoint.

proteomexchange-skill