The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language to generate and execute SQL queries against metadata views. This creates an attack surface for indirect prompt injection if malicious data is embedded in the metadata (e.g., table comments) that influences agent behavior during synthesis.
Ingestion points: User queries processed in SKILL.md and custom SQL input in scripts/odps_is_query.sh.
Boundary markers: The instructions recommend using hints and specific SQL prefixes, but do not enforce strict delimiters for untrusted data ingestion.
Capability inventory: Execution of SQL via execute_sql (MCP) and shell command execution via odps_is_query.sh.
Sanitization: scripts/odps_is_query.sh includes regex validation for table names and a denylist for DDL/DML keywords (e.g., INSERT, DROP, TRUNCATE) in custom query mode.
[COMMAND_EXECUTION]: The script scripts/odps_is_query.sh executes the odpscmd utility. While it employs validation (regex for table names and project names, keyword denylist for SQL) to mitigate injection, it remains a capability that runs shell commands based on variable inputs.
[DYNAMIC_EXECUTION]: The skill dynamically generates SQL statements using templates and user-provided identifiers (table names, column names) which are then executed at runtime via MCP tools or the odpscmd CLI helper.

alibabacloud-odps-information-schema