The Agent Skills Directory

[Dynamic Execution] (MEDIUM): The skill utilizes model.load() across multiple models (e.g., SCVI, PeakVI, VeloVI). In Python machine learning frameworks, these functions frequently rely on pickle or torch.load internally, which can be exploited for arbitrary code execution if a user loads a malicious model directory from an untrusted source.
[Indirect Prompt Injection] (MEDIUM): The skill ingests untrusted data from external files (e.g., .h5ad files) via scanpy.read_h5ad. While the skill targets scientific analysis, metadata within these files (such as cell type labels or batch keys) could be used to influence agent behavior if the agent treats this metadata as instructional content. 1. Ingestion points: scanpy.read_h5ad in references/models-atac-seq.md and references/models-scrna-seq.md. 2. Boundary markers: Absent. 3. Capability inventory: File-write via model.save, file-read/potential-execution via model.load. 4. Sanitization: Absent.
[Unverifiable Dependencies & Remote Code Execution] (LOW): The installation instructions in SKILL.md recommend installing scvi-tools via pip. Although scvi-tools is a reputable scientific library, the installation of third-party packages remains a potential attack vector. Per [TRUST-SCOPE-RULE], this is downgraded to LOW due to the library's established standing in the research community.
[Command Execution] (LOW): The skill performs local file system operations including reading biological datasets and writing trained models to disk (model.save), which represents a standard capability surface for data analysis tools.

scvi-tools