The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interfaces with the pandaai-cli tool via scripts/pandaai_cli_wrapper.py. This wrapper script utilizes subprocess.run with list-based arguments, effectively mitigating shell injection risks. The execution of platform commands is gated by a mandatory --execute switch in the runner script, ensuring no actions are performed without explicit user consent.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface for processing external research papers, PDF, and DOCX files. This constitutes an indirect prompt injection surface. However, the skill provides specific extraction instructions to the agent to focus on structured data (formulas and parameters) rather than general command execution, and these capabilities are intrinsic to the skill's primary research function.
[EXTERNAL_DOWNLOADS]: The skill documentation specifies dependencies such as pandaai-cli and pdfplumber to be installed from official package registries. These downloads are legitimate, documented requirements for the skill's intended functionality.
[CREDENTIALS_SAFE]: The skill correctly handles authentication by directing users to use the interactive login command of the CLI tool. It explicitly warns against including sensitive information such as phone numbers, tokens, or configuration contents in prompts or the repository, following secret management best practices.

factor-mining-pandaai