The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a workflow that allows reading local files from arbitrary paths provided by the user.
Evidence: The load_test_entry tool takes a dataset_path parameter. The instructions guide the agent to call this tool with a user-supplied path (e.g., <path> entry 5) and then display the results for confirmation.
Risk: This can be abused for path traversal to read sensitive configuration files or credentials if they are formatted in a way the tool can parse.
[COMMAND_EXECUTION]: The skill uses a dynamic code generation and execution pattern through a custom domain-specific language (DSL).
Evidence: The agent is instructed to write DSL code (a 'Python-like DSL') and pass it to tools like parse_dsl_tool and compile_substrait for processing and conversion to Substrait JSON.
Risk: Dynamic evaluation of generated code poses a risk if the underlying parser/executor does not provide strict sandboxing or if it allows arbitrary code execution through the DSL syntax.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of external datasets and user queries.
Ingestion points: Untrusted data enters via the dataset_path in load_test_entry and the raw user query.
Boundary markers: None identified; the skill does not use delimiters or instructions to ignore embedded commands in the processed data.
Capability inventory: The skill can read files (load_test_entry) and execute transformations (parse_dsl_tool, compile_substrait).
Sanitization: No sanitization or validation of the content fetched from external JSONL files is specified before it is used to generate DSL code.

di-agent-query-substrait