The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions involve reading and modifying ~/.dbt/profiles.yml. This file is a standard dbt configuration file that frequently contains sensitive database credentials, including passwords and access tokens. Although the skill includes instructions not to log these details, the agent has full read and write access to the file.
[REMOTE_CODE_EXECUTION]: The skill executes the dbt-autofix tool directly from the dbt-labs GitHub repository using the uvx command. This represents dynamic execution of code fetched from a remote source.
[METADATA_POISONING]: There is a discrepancy between the skill author metadata in SKILL.md (which claims dbt-labs) and the system-provided author context (which identifies the author as kilo-org), suggesting potential brand spoofing or metadata manipulation.
[COMMAND_EXECUTION]: The skill uses powerful bash commands for environment debugging, project compilation, and package management, including dbt debug, dbtf compile, and rm -rf target/.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data from SQL files, YAML configuration files, and terminal error logs, creating a potential surface for injection attacks.
Ingestion points: reads profiles.yml, project SQL/YAML files, and terminal output from dbt commands.
Boundary markers: The skill body includes instructions to treat project content as untrusted and to ignore any instruction-like text within processed files.
Capability inventory: Terminal command execution, file system modifications (Write/Edit), and network fetching via WebFetch.
Sanitization: The instructions recommend manual oversight for specific operations like diff approvals but do not define programmatic sanitization for ingested content.

dbt-migration