The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes deployment evidence packets from external JSON files. This creates a surface for indirect prompt injection if an attacker could influence the CI-generated evidence. However, the skill implements comprehensive mitigations: Ingestion points include snowflake-deploy-evidence.json via the Read tool. Boundary markers are defined by strict "Hard boundaries" and "Prerequisites" in the instructions. The agent is restricted to read-only tool access, and the included Python script is a pure JSON parser with no network or subprocess capabilities. The script also includes a _reject_secrets function to sanitize sensitive patterns. Sanitization includes secret scanning and strict schema validation.\n- [PROMPT_INJECTION]: The deterministic detector flagged an "Ignore previous instructions" string in eval-spec.yaml. Analysis confirms this is part of a negative test case in the evaluation suite designed to verify the agent's robustness against injection attacks, rather than an attempt to subvert the agent's behavior.\n- [COMMAND_EXECUTION]: The skill instructions and internal script logic emphasize a "no-apply" policy. The script scripts/analyze_deploy_evidence.py is a pure JSON reader that does not invoke shells, Terraform, or Snowflake CLI, and this property is enforced via unit tests using AST analysis to verify the absence of dangerous functions like os.system or subprocess.run.

snowflake-deploy-medic