The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external sources that could contain malicious instructions.
Ingestion points: The skill ingests data from warehouse queries via dbt show, project artifacts like target/run_results.json, and API responses from the dbt package registry (hub.getdbt.com). These sources are considered untrusted as they may contain user-generated content or external metadata.
Boundary markers: The skill includes explicit security guidelines in SKILL.md and references/managing-packages.md, instructing the agent to treat all query results and API responses as untrusted and to ignore instruction-like text within data values.
Capability inventory: The agent has significant capabilities including shell command execution (Bash(dbt *)), file reading/writing (Read, Write, Edit), and Python script execution for reviewing run results.
Sanitization: The instructions emphasize validating query outputs against expected schemas and extracting only structured fields to prevent the execution of embedded instructions.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party dbt packages using the dbt deps command.
Source: Packages are fetched from hub.getdbt.com, which is the official registry for dbt, a well-known data transformation service.
Mitigation: The documentation includes a security note requiring user confirmation before running dbt deps and advising a review of the package source and version to prevent supply chain attacks.

using-dbt-for-analytics-engineering