The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reveals specific internal project identifiers and dataset names belonging to an organization (e.g., monzo-analytics, monzo-analytics-pii, raw-analytics-events-prod, sanitized-events-prod). While intended for internal use, this information disclosure facilitates reconnaissance of the organization's data infrastructure.
[COMMAND_EXECUTION]: The skill provides numerous examples of shell command execution using the bq command-line tool. It specifically demonstrates exporting data to the local filesystem using shell redirection to /tmp/columns.txt.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external BigQuery tables, which represents an attack surface for indirect prompt injection.
- Ingestion points: Data retrieved from BigQuery via bq query is ingested into the agent's execution context (SKILL.md).
- Boundary markers: The instructions do not define delimiters or specific warnings to differentiate retrieved data from the agent's instructions.
- Capability inventory: The skill allows for network operations (via bq CLI) and file system writes (via shell redirection in SKILL.md).
- Sanitization: There is no mention of sanitizing, escaping, or validating the results of the database queries before they are processed by the agent.

bigquery