The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes arbitrary user input via argument variables ($0 and $1) and embeds them into shell command environments and DuckDB query parameters without sanitization. If an input filename or question contains shell metacharacters or nested SQL escape characters, it could lead to unexpected behavior or arbitrary execution pipelines inside the allowed Bash tool execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data files (e.g., CSV, JSON, Jupyter Notebook structures) and parses their schema and preview values directly into the model context. A file designed maliciously could contain instruction sequences intended to trick the model into deviating from its task during the 'Step 2 — Answer' phase.
Ingestion points: Reads files and remote URLs passed through the argument handler inside SKILL.md via duckdb functions like read_csv and read_json_auto.
Boundary markers: None explicitly present to separate file data contents from agent instructions in the step 2 answering phase.
Capability inventory: Uses the Bash tool to run the duckdb binary and find files via find command wrappers.
Sanitization: Content filtering or text escaping is absent on the incoming file contents or argument interpolations.

read-file