The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the bash tool to perform git operations, such as git show HEAD:path/to/file.sql. This introduces a potential command injection surface if the file paths or arguments provided by a user are not strictly validated by the agent before being passed to the shell execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests SQL content from external files on disk or from git history to perform lineage analysis, which could contain malicious instructions.
Ingestion points: SQL files are read using the read tool or retrieved through git show using bash as described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety prompts to ensure the agent ignores natural language instructions that might be embedded within SQL comments or strings.
Capability inventory: The skill has access to bash for shell execution, read for file system access, and glob for file discovery, providing a surface for action if an injection is successful.
Sanitization: There is no explicit mention of sanitizing or filtering the SQL content before it is processed by the agent or the lineage_check tool.

lineage-diff