The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local helper script, gb-call, located within the plugin root directory to manage interactions with the GrowthBook API. This tool is used for legitimate administrative and analytical tasks such as searching for metrics and creating dashboards via Bash commands.
[DATA_EXFILTRATION]: The skill is designed to read API credentials from either the GB_API_KEY environment variable or the ~/.config/growthbook/.env file. Accessing local configuration files for credential management is a standard and documented integration pattern for this service and does not constitute unauthorized exposure.
[DYNAMIC_EXECUTION]: The sql-query.md workflow allows the agent to generate and execute SQL queries against a user's data warehouse. The instructions strictly limit this to read-only operations (SELECT and WITH statements) and implement a 500-row result limit to prevent resource exhaustion or bulk data extraction.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from API responses and data warehouse queries. It implements a strong security posture by requiring the agent to use discovery tools (such as the column-values endpoint) to verify data before incorporating it into API requests or filters, minimizing the risk of processing malicious instructions embedded in data.

analytics