The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's I/O documentation in 'references/io.md' promotes the use of the Python 'pickle' module for saving and loading graph data (via pickle.load() and nx.read_gpickle()). Deserializing data from untrusted sources using pickle is an inherently unsafe operation that can lead to arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill provides extensive functionality for reading data from untrusted external sources, including CSV, GraphML, JSON, and SQL databases (documented in 'references/io.md'). This ingestion surface, coupled with the agent's capability to execute code and perform file operations, creates a potential for indirect prompt injection if malicious instructions are embedded within the network data files.
[EXTERNAL_DOWNLOADS_AND_RCE]: The skill instructs users to install several third-party Python packages, including 'networkx', 'matplotlib', 'pandas', 'numpy', 'scipy', 'plotly', 'pyvis', 'pydot', and 'pyshp'. While these are well-known libraries, they represent the execution of external code on the user's system.

networkx