The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external, potentially untrusted remote storage buckets and displays it to the agent, creating a surface for indirect instructions.
Ingestion points: The skill uses read_blob, parquet_metadata, and FROM '<URL>' queries to fetch remote data in SKILL.md.
Boundary markers: There are no delimiters or 'ignore embedded instructions' warnings around the interpolated data.
Capability inventory: The skill has access to the Bash tool and executes duckdb CLI commands.
Sanitization: No sanitization or filtering is applied to the content retrieved from remote URLs before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill generates shell commands by interpolating the user-provided URL ($0) and question ($1) directly into a duckdb -c call.
Evidence: The pattern duckdb -c "... FROM '<URL>' ..." in SKILL.md is vulnerable to command injection if the URL contains shell metacharacters (e.g., backticks, subshells) or SQL injection if it contains single quotes.

s3-explore