The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/collect_snowflake_evidence.py script utilizes subprocess.run to interact with the Snowflake CLI (snow). This implementation follows security best practices by passing the command as a list of arguments and strictly validating all interpolated variables (such as package names or roles) against restrictive regular expressions (e.g., IDENTIFIER_RE, PROFILE_RE). This prevents command injection and SQL injection into the Snowflake-side templates.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from Snowflake, which represents a potential surface for indirect prompt injection. However, the system implements robust mitigations:
Ingestion points: Snowflake CLI output and the evidence JSON bundle.
Boundary markers: The analyzer script (scripts/analyze_native_app_release.py) enforces a strict JSON schema contract and uses fail-closed logic.
Capability inventory: Capabilities are limited to Read and Bash for Python execution.
Sanitization: The tool uses SHA256 hash-binding for all inputs, ensuring that the evidence cannot be tampered with between collection and analysis. It also explicitly filters and redacts raw identifiers and sensitive metadata.
[DATA_EXPOSURE]: The skill includes advanced redaction logic in the collector script to prevent data exfiltration or accidental exposure. It uses comprehensive regular expressions to identify and redact authorization headers, authentication tokens, presigned URLs, and sensitive keys (e.g., apikey, password, secret) from any output tree before it is returned to the agent.
[SAFE]: The skill is designed with a 'fail-closed' architecture, meaning any missing, stale, or malformed evidence results in a BLOCKED status, preventing unsafe release approvals due to incomplete information. All logic is local and does not involve external network calls to non-trusted sources.

snowflake-native-app-release-sheriff