The Agent Skills Directory

[SAFE]: The skill utilizes a hash-only data model, employing SHA-256 to mask Snowflake identifiers (databases, schemas, tables, columns) and user identities, ensuring that governed names are not exposed in the final analysis.
[SAFE]: The collect_snowflake_evidence.py script implements strict input validation on all CLI arguments using specific regular expressions for Snowflake identifiers, effectively preventing SQL injection via the template rendering process.
[SAFE]: A security-focused SQL validator (validate_read_only_sql) checks all SQL templates and rendered queries for forbidden mutation or session-modifying keywords like DROP, INSERT, ALTER, and EXECUTE, enforcing a read-only execution boundary.
[SAFE]: The skill includes advanced redaction logic in sanitize_output_tree and redact_authorization_values to detect and filter out hardcoded credentials, authorization headers, and sensitive metadata from command output and error messages.
[SAFE]: The analyze_governance.py script requires external SHA-256 digests to be provided via CLI arguments to verify the integrity of evidence and policy files, preventing the processing of tampered or unauthorized data.
[SAFE]: Subprocess calls to the snow CLI are handled safely using list-based arguments without a shell, and the connection profile name is validated against a strict character whitelist to prevent command injection.
[SAFE]: The skill operates entirely without external third-party dependencies or unauthorized remote network calls, relying only on the standard library and the pre-installed Snowflake CLI.
[SAFE]: Analysis results distinguish between observable coverage and evidence gaps without making definitive compliance claims, and remediation recommendations are provided as non-executable action codes requiring manual review.

snowflake-governance-coverage-auditor