The Agent Skills Directory

[COMMAND_EXECUTION]: The collect_snowflake_evidence.py script uses subprocess.run to call the Snowflake CLI (snow). This is a legitimate requirement for collecting provider evidence. The implementation follows security best practices by passing arguments as a list (avoiding shell injection) and validating all user-supplied inputs, such as the connection profile name, against restrictive regular expressions.
[DYNAMIC_EXECUTION]: The collect_snowflake_evidence.py script dynamically renders SQL templates by substituting placeholders with validated identifiers. To mitigate risk, the script passes the rendered SQL through a validation function that blocks dangerous mutation keywords (e.g., GRANT, DROP, ALTER) and ensures all statements start with safe keywords like SELECT or SHOW.
[INDIRECT_PROMPT_INJECTION]: The skill processes external provider-side metadata which could theoretically contain malicious instructions.
Ingestion points: The analyze_native_app_release.py script ingests JSON evidence packets provided as local files.
Boundary markers: The system uses a strict evidence contract and enforces independent SHA256 hashes for the bundle, manifest, setup scripts, and cohorts to ensure data integrity.
Capability inventory: The analysis script itself is strictly data-driven and lacks shell execution, file-write, or network capabilities. The separate collector script is restricted to Snowflake CLI read operations.
Sanitization: The collector implements extensive redaction for authorization headers and credentials. The analyzer uses schema-based validation to reject any malformed or unexpected data structures.

snowflake-native-app-release-sheriff