The Agent Skills Directory

[SAFE]: The skill implements a strong security posture focused on data privacy and read-only access to Snowflake environments.
Redaction Logic: Both scripts/analyze_query_evidence.py and scripts/collect_snowflake_evidence.py contain sophisticated redaction mechanisms. They use regular expressions and tokenization to identify and mask Authorization headers, passwords, tokens, and raw SQL fragments within query history and error messages.
Data Pseudonymization: Sensitive identifiers such as user_name and query_tag are pseudonymized using SHA-256 hashes directly within the Snowflake SQL collection template (scripts/sql/query.sql) before the data reaches the agent context.
Integrity Verification: The skill uses a digest-based trust anchor system (--trusted-input-sha256). This allows operators to record a canonical digest at a trusted local boundary to ensure evidence hasn't been tampered with before analysis.
Mutation Prevention: scripts/collect_snowflake_evidence.py includes a validate_read_only_sql function that scans SQL for forbidden mutation keywords (e.g., ALTER, DROP, DELETE, GRANT) and unsupported system functions, ensuring the agent cannot execute destructive commands.
Input Validation: Command-line arguments for scripts are strictly validated against specific regex patterns (e.g., Snowflake UUIDs, identifiers, and UTC timestamps), effectively preventing command injection vulnerabilities.

snowflake-query-forensics