The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute Python scripts (validate_syntax.py, check_best_practices.py) via the shell, passing user-provided PromQL queries as arguments. While the instructions suggest wrapping the input in double quotes, a crafted query containing escaped quotes could potentially lead to command injection if the agent does not properly escape the input before executing the command.
[COMMAND_EXECUTION]: The scripts/test_validators.py file uses subprocess.run to call the validator scripts. A manual review confirms this is a safe implementation as it passes arguments as a list and does not enable shell=True, effectively preventing command injection within the test environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user-supplied data in the form of PromQL queries.
Ingestion points: User-provided queries are ingested at Step 1 and Step 2 in SKILL.md to be analyzed by script-based tools.
Boundary markers: The instructions lack explicit boundary markers or warnings to the model to ignore any instructions potentially embedded within the PromQL comments or metric names.
Capability inventory: The skill has shell execution capabilities via python3 to run its validation logic.
Sanitization: There is no explicit sanitization or escaping step defined for the user input before it is interpolated into the CLI command or interpreted by the LLM during the 'Explain the Query' phase.

promql-validator