The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface because its core functionality involves parsing and processing untrusted SQL queries and dataset metadata provided by users or external systems.
Ingestion points: The extract_column_lineage Python function and various SQL parsing examples in SKILL.md, references/lineage-automation.md, and references/lineage-graph-model.md process untrusted SQL strings.
Boundary markers: The implementation examples lack delimiters or clear instructions to ignore any potential conversational prompts embedded within the SQL queries.
Capability inventory: The skill has access to network tools (requests, curl), file modification capabilities (dbt profiles.yml), and metadata management APIs, which could be abused if an injected prompt successfully overrides the agent's behavior.
Sanitization: There is no logic present for sanitizing, escaping, or validating the external SQL content before it is interpolated into functions or parsed.
[EXTERNAL_DOWNLOADS]: The skill documentation references several third-party libraries required for its lineage tracking functionality.
Python packages: sqllineage, sqlparse, sqlglot, openlineage-airflow, dbt-openlineage, openlineage-python, marquez-python-client, acryl-datahub, and atlan-python are documented.
These are legitimate, well-known packages in the data engineering domain used for their intended metadata collection and parsing tasks.
[SAFE]: Network operations are restricted to local or expected infrastructure targets, such as localhost, marquez:5000, and datahub-gms:8080, which are appropriate for a data governance tool.
[SAFE]: Multiple reference files (e.g., references/architecture-patterns.md, references/testing-strategies.md) contain over 100 sections of highly repetitive technical filler text. While this content is deceptive in its volume and presentation, it does not appear to contain malicious executable code or obfuscated payloads.

data-lineage