The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone an external repository from https://github.com/mcmero/labarchives-py, which is not a verified or trusted source.
[REMOTE_CODE_EXECUTION]: Following the download, the instructions direct the user to run uv pip install ., which executes setup scripts from the untrusted repository to install the package.
[COMMAND_EXECUTION]: The skill relies on executing several local Python scripts (setup_config.py, notebook_operations.py, and entry_operations.py) to perform operations such as configuration setup, notebook backups, and data uploads.
[CREDENTIALS_UNSAFE]: The documentation provides an example command for a complete backup that passes an authentication token directly as a command-line argument (--password AUTH_TOKEN). This practice exposes sensitive credentials to shell history, process listings, and logs.
[DATA_EXFILTRATION]: The skill is designed to transfer research notebooks and file attachments between the local environment and external LabArchives API endpoints. While this is the intended use case, it involves the handling of sensitive research data via untrusted scripts.
[PROMPT_INJECTION]: The skill processes data from LabArchives (entries, comments, and attachments) which could contain indirect prompt injections. These could influence the agent's behavior if the data is processed without strict sanitization or boundary markers.

labarchive-integration