The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Usage' section instructions recommend adjusting the DATEADD interval based on user input (e.g., /cost-report 7). This pattern introduces a SQL injection vulnerability because the agent is instructed to interpolate user-provided values directly into a SQL query template without validation or sanitization rules, allowing a user to potentially escape the query structure.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and analyzes query_text from the Snowflake QUERY_HISTORY table, which serves as a significant attack surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through the output of the sql_execute tool in Step 1 of the workflow, specifically the query_text column.
Boundary markers: The instructions lack any delimiters or 'ignore instructions within data' warnings to help the agent distinguish between its instructions and the query text being analyzed.
Capability inventory: The skill utilizes sql_execute, sql_analyze, and several FinOps tools to process the retrieved data and generate a detailed markdown report.
Sanitization: There is no evidence of escaping, filtering, or validation performed on the query_text before it is passed to sql_analyze or summarized in the final report.

cost-report