The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including user questions and DataHub catalog metadata (curated documents, glossary terms, and search results). Malicious instructions embedded in these sources could potentially influence the agent's logic, especially as the skill instructs the agent to treat 'user_edited matches' and their instructions as 'authoritative'.
Ingestion points: Data enters the context via find_sql_context, search_documents, grep_documents, and direct user questions.
Boundary markers: The skill does not define clear delimiters to distinguish between instructional prompts and the data retrieved from the catalog.
Capability inventory: The agent has the ability to execute SQL queries, search/read catalog documents, and post metadata observations.
Sanitization: The skill includes robust mitigation strategies, such as instructing the agent to treat generated SQL as 'untrusted' and strictly limiting execution to single, read-only SELECT statements, while explicitly rejecting DDL and DML operations.
[COMMAND_EXECUTION]: The skill is designed to generate and execute SQL commands against a database. While this is a high-privilege capability, the instructions mandate that the agent only execute read-only SELECT statements and CTEs, effectively preventing destructive actions or unauthorized schema modifications.

datahub-sql-workflow