The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides instructions and SQL templates for generating new SQL queries by querying database catalogs (such as information_schema.tables in DuckDB or sqlite_master in SQLite). The resulting strings are intended to be executed by the agent to perform operations like unions over many tables. Although the patterns include logic to escape double quotes and single quotes in identifiers, the runtime generation and execution of code based on external metadata (table names) is a form of dynamic execution that can be vulnerable to injection if the underlying metadata is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze data from connected warehouses, including text content such as messages or customer data. This ingestion of external, potentially untrusted content poses a risk of indirect prompt injection.
Ingestion points: Data is pulled into the agent's context through the sql_execute tool and by reading result spill files via the read tool.
Boundary markers: The instructions do not define clear delimiters or provide explicit "ignore embedded instructions" warnings for the agent when processing text from the database.
Capability inventory: The skill utilizes sql_execute, sql_materialize, and read, which provide significant capabilities for reading database content, creating tables, and reading local file paths reported by other tools.
Sanitization: While the instructions advise inspecting text for formatting issues like whitespace, there are no specific sanitization steps to filter or escape potential natural language instructions embedded within the data records before they are processed by the agent.

data-question