The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/tune.py dynamically loads and executes a Python file from the user's workspace.
Evidence: The load_session_udfs function in scripts/tune.py checks for a file named udf_setup.py in the current directory and executes its register_udfs function using importlib. While intended for registering Spark UDFs, this allows for the execution of arbitrary code if a malicious file is placed in the directory where the skill is invoked.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes an installation script for the uv package manager from its official source.
Evidence: Both SKILL.md and scripts/env_setup.py reference the command curl -LsSf https://astral.sh/uv/install.sh | sh. The domain astral.sh belongs to Astral, a well-known technology company in the Python ecosystem.
[COMMAND_EXECUTION]: The skill uses subprocess.run to interact with system tools and local scripts.
Evidence: scripts/discover.py executes databricks CLI commands. scripts/init_run.py uses git for branch and file management. scripts/env_setup.py manages virtual environments via uv. These are necessary for the skill's functionality but involve executing shell commands based on internal logic.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection via user-supplied SQL queries.
Ingestion points: User-provided SQL strings or file contents via the /databricks-sql-autotuner command (processed in SKILL.md and scripts/tune.py).
Boundary markers: No specific delimiters or safety instructions are used to wrap the input SQL.
Capability inventory: The skill can execute shell commands, perform Git operations, and run SQL queries on a Databricks cluster.
Sanitization: No sanitization or validation of the SQL content is performed before execution.

databricks-sql-autotuner