The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install and depend on the datacommons-client Python package. This package is not the official library provided by the Data Commons project (which is typically named datacommons).
[COMMAND_EXECUTION]: The documentation includes multiple shell commands for package installation:
uv pip install "datacommons-client[Pandas]" in SKILL.md
pip install "datacommons-client[Pandas]" in references/getting_started.md.
[SUPPLY_CHAIN_RISK]: There is a significant inconsistency between the instructed package (datacommons-client) and the provided 'Official' links. SKILL.md points to https://github.com/datacommonsorg/api-python as the official repository, but that repository corresponds to the datacommons package. Requesting a 3rd-party package while claiming official status is a pattern associated with dependency confusion or typosquatting.
[DATA_EXPOSURE_RISK]: The skill requires users to provide a DC_API_KEY via environment variables or constructor arguments. While standard for API access, the use of an unverified 3rd-party package (datacommons-client) instead of the official one creates a risk that these credentials could be intercepted or exfiltrated by the library's code.

datacommons-client