The Agent Skills Directory

[SAFE]: The skill provides legitimate integration with the protocols.io scientific platform. All API communication is directed to the official and well-known endpoint (https://protocols.io/api/v3).
[CREDENTIALS_UNSAFE]: The skill uses industry-standard authentication methods (Bearer tokens and OAuth). Documentation and examples correctly use placeholders (e.g., 'YOUR_ACCESS_TOKEN') instead of hardcoding any sensitive credentials.
[COMMAND_EXECUTION]: Code examples provided in the documentation use the standard Python 'requests' library to interact with the API. There is no evidence of arbitrary command execution or shell injection vulnerabilities.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external, user-generated data from a public platform (protocols and comments).
Ingestion points: The agent retrieves untrusted data via GET /protocols, GET /publications, and GET /protocols/{id}/comments across multiple reference files.
Boundary markers: No explicit delimiters or 'ignore' instructions are provided for handling content returned from the API.
Capability inventory: The skill can perform network operations (API calls) and file management tasks (upload/download).
Sanitization: There is no mention of sanitizing or escaping the content retrieved from protocols.io before the agent processes it.

protocolsio-integration