The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script scripts/snowflake_query_helper.py designed to be executed via the command line to generate SQL templates. The script uses standard libraries and performs local string manipulation to output SQL code for MERGE, Dynamic Tables, and RBAC grants. There is no evidence of command injection or malicious subprocess spawning.
[CREDENTIALS_UNSAFE]: The skill correctly identifies hardcoded credentials as a risk. It provides Snowpark Python examples that use os.environ to retrieve Snowflake credentials (SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_PASSWORD). While it mentions these sensitive keys, it follows security best practices by instructing the user to manage them via environment variables or key-pair authentication rather than hardcoding them in the skill files.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were found. All scripts and references are local, and there are no instances of curl | bash or similar risky download-and-execute behaviors.
[DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill does not perform unauthorized network requests or attempt to read sensitive system files like SSH keys or AWS credentials.
[OBFUSCATION]: The skill contains no obfuscated code, hidden URLs, or encoded payloads. All instructions and scripts are in plain text and behave as described.

snowflake-development