The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the ClickHouse system.query_log table, which records the history of all queries executed on the server. An attacker capable of running queries on the database could embed malicious instructions within SQL comments that the agent might inadvertently follow during log analysis.
Ingestion points: Queries against system.query_log, system.parts, and system.metrics defined in references/collectors.md and references/diagnostic-queries.md.
Boundary markers: Absent. The skill provides no instructions to the agent to disregard or isolate potentially malicious content within the logs.
Capability inventory: The skill is configured to use Bash(curl:*) and Bash(tar:*) for data collection and packaging.
Sanitization: None. The diagnostic data is collected and presented in its raw format.
[DATA_EXFILTRATION]: The skill collects comprehensive logs from system.query_log, which inherently contains the full text of queries executed on the server. These logs often include sensitive data, PII, or credentials that were part of SQL statements (e.g., in INSERT or WHERE clauses) and are packaged for external sharing with support teams.
Evidence: The bash and Node.js collectors in references/collectors.md explicitly query system.query_log and system.events for the purpose of creating a support bundle.
[COMMAND_EXECUTION]: The automated diagnostic collector scripts use system tools to perform network requests and archive data.
Evidence: The clickhouse-debug-bundle.sh script in references/collectors.md utilizes curl for HTTP communication with the database and tar for generating the diagnostic archive.

clickhouse-debug-bundle