The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/search_ml_datasets.py uses subprocess.run to execute the GitHub CLI (gh). While it uses the list-based argument format to mitigate shell injection, it is vulnerable to path traversal during workspace management.
Evidence: In scripts/search_ml_datasets.py, the source variable is parsed from user input via the --dataset-id argument using partition(':'). This unvalidated string is then concatenated into a file path: Path(args.workspace) / 'datasets' / f'{source}_{safe_slug(dataset_id)}'. An attacker could provide an ID like ../../restricted:dataset to write files to unintended locations.
[EXTERNAL_DOWNLOADS]: The skill fetches data from HuggingFace, OpenML, and Semantic Scholar.
Evidence: The script performs network requests to huggingface.co/api/datasets, www.openml.org/api, and api.semanticscholar.org to retrieve dataset metadata and sample rows.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external APIs, which can be manipulated by attackers to influence the agent's behavior.
Ingestion points: Data is retrieved from Semantic Scholar abstracts, GitHub repository descriptions, and HuggingFace dataset metadata in scripts/search_ml_datasets.py.
Boundary markers: Absent. External content is formatted directly into markdown tables or README files without delimiters or instructions for the agent to ignore embedded instructions.
Capability inventory: The skill can execute the gh CLI via subprocess.run and perform file write operations (metadata.json, README.md, sample.jsonl).
Sanitization: The script uses safe_slug for the dataset identifier but fails to sanitize the source prefix (leading to the path traversal mentioned above) and does not escape or validate the textual content retrieved from the APIs.

dataset-discovery