The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for reading and processing external data from Bigtable, which introduces a surface for indirect prompt injection attacks.
Ingestion points: The skill uses cbt read and cbt sql (as described in references/cli_data_access.md and references/sql_guide.md) to pull data from a database into the agent's context.
Boundary markers: While the skill includes a "Safety Rule" in SKILL.md requiring user confirmation for changes, it does not specify markers or instructions to treat data retrieved from the database as untrusted content.
Capability inventory: The skill includes instructions for high-privilege operations such as deleting instances (gcloud bigtable instances delete), deleting tables (cbt deletetable), and modifying data (cbt set or cbt deleterow), creating a potential impact if the agent is manipulated by data it reads.
Sanitization: There are no documented steps for sanitizing or escaping the output of database queries before the agent processes them.
[COMMAND_EXECUTION]: The skill instructions guide the agent to generate and execute shell commands using the gcloud and cbt CLI tools for infrastructure management and data manipulation. These operations are essential to the skill's purpose but involve the execution of system-level commands.
[EXTERNAL_DOWNLOADS]: The skill references external resources from official Google Cloud domains and repositories.
Evidence: Links to documentation and sample code on cloud.google.com and github.com/googlecloudplatform are provided in SKILL.md and references/client_libraries.md. These references target a well-known service and the vendor's own infrastructure.

bigtable-basics