The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install datacommons-client using uv pip install. This is a non-standard package name for accessing Data Commons; the official and widely recognized library is named datacommons.
[EXTERNAL_DOWNLOADS]: There is a suspicious discrepancy between the suggested package and the official GitHub repository linked in the documentation (https://github.com/datacommonsorg/api-python), which itself recommends the datacommons package.
[COMMAND_EXECUTION]: Code examples in references/getting_started.md demonstrate writing data to the local file system using comparison.to_csv('ca_cities_comparison.csv').
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing data retrieved from the public Data Commons API. Ingestion points: Statistical data and entity metadata are retrieved via client.observation.fetch, client.node.fetch, and client.resolve.fetch methods. Boundary markers: No delimiters or instructions are provided to distinguish between agent logic and potentially attacker-influenced data from the API. Capability inventory: The agent has the capability to write files and display visual output. Sanitization: The skill does not describe any validation or filtering of the retrieved data.
[SAFE]: The documentation follows security best practices by recommending the use of environment variables (e.g., DC_API_KEY) for managing API credentials.

datacommons-client