The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install the labarchives-py package from a GitHub repository (https://github.com/mcmero/labarchives-py) that is not managed by a trusted organization or well-known service. This constitutes an unverifiable dependency from an unknown third-party source.
[DATA_EXFILTRATION]: The scripts/entry_operations.py script contains upload and batch-upload functionalities that transmit local file data to the LabArchives API. While this is the intended purpose, it creates a vector for exfiltrating sensitive local files if the agent is manipulated into targeting unauthorized file paths.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes content from external LabArchives notebooks.
Ingestion points: Notebook entry content and metadata retrieved via API calls in scripts/notebook_operations.py and scripts/entry_operations.py.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the documentation or scripts.
Capability inventory: The skill can execute local scripts, write to the file system (backups), and perform network operations (API requests).
Sanitization: No evidence of sanitization or validation of notebook content was found in the provided scripts.
[COMMAND_EXECUTION]: The skill relies on the execution of several local Python scripts that interact with the system environment and network to manage lab records.

labarchive-integration