The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in references/io.md and SKILL.md encourages the use of pickle.load(), pickle.dump(), and the NetworkX wrappers nx.read_gpickle() and nx.write_gpickle(). Deserializing data using the Python pickle module is inherently unsafe and can result in arbitrary code execution if the input file has been tampered with or originates from an untrusted source.
[EXTERNAL_DOWNLOADS]: The skill instructs users on how to install the networkx library and its optional dependencies—including matplotlib, pandas, numpy, scipy, plotly, pyvis, and pyshp—using the pip package manager. These are standard, well-maintained packages in the Python ecosystem.
[DATA_EXFILTRATION]: The skill provides detailed instructions for reading from and writing to local file systems and SQL databases (via sqlite3). While this is core functionality for data analysis, it creates a surface for potential data exposure if the agent is directed to access sensitive paths or untrusted database instances.

networkx