The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official Snowflake CLI through a well-known package manager if the tool is not already present. This ensures the environment is provisioned with authentic tooling.
[COMMAND_EXECUTION]: All interactions with the Snowflake CLI are managed through a shell wrapper that avoids shell interpolation vulnerabilities by using array-based execution. The wrapper enforces an explicit confirmation mechanism for any operation identified as a data or schema mutation.
[DATA_EXFILTRATION]: The skill implements stringent local security policies for handling authentication tokens, including verifying file ownership, prohibiting symbolic links for sensitive paths, and enforcing minimal file system permissions (0600) to prevent unauthorized local access.
[PROMPT_INJECTION]: The wrapper identifies potentially destructive SQL queries using a localized regular expression to trigger user confirmation. While this is a safety feature, it relies on pattern matching which can be bypassed by certain SQL structures, representing an indirect prompt injection surface when processing data from untrusted database sources.
Ingestion points: SQL query results returned from the database to the agent context (scripts/snowflake.sh).
Boundary markers: The wrapper provides explicit --preview and --execute markers to separate inspection from execution.
Capability inventory: The skill can execute arbitrary SQL and Snowflake CLI commands (scripts/snowflake.sh).
Sanitization: The wrapper includes a regex-based is_read_only_sql filter and shell-argument escaping using printf %q.

snowflake