The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow involves using the bash tool to run commands like git show HEAD:path/to/file.sql. If a user provides a file path containing shell metacharacters (such as ;, &&, or |), it could potentially lead to the execution of unintended commands on the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it reads and processes external SQL files which could contain malicious instructions.
Ingestion points: SQL model files are read from the disk or retrieved from git history via the read and bash tools in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or use 'ignore instructions' guards to wrap the untrusted SQL content being analyzed.
Capability inventory: The agent has access to bash, read, glob, and lineage_check tools, which could be leveraged if an injection occurs.
Sanitization: There is no evidence of path validation or content sanitization implemented within the skill instructions.

lineage-diff