The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Multiple scripts ingest untrusted data from the user and pass it directly to Looker SDK methods without sanitization or boundary markers.
Ingestion Points: scripts/generate_lookml.py (variables: user_intention, questions, user_instructions), scripts/bq_view_lookml_generator.py (sql_content), scripts/create_custom_view.py (sql_query), and scripts/upload_assets.py (file_content).
Boundary Markers: None identified in the script logic or the SKILL.md instructions.
Capability Inventory: The skill can execute arbitrary SQL queries (run_sql_query), write or update files in the Looker project (create_file, update_file), and trigger AI-powered LookML generation (generate_lookml_with_new_files).
Sanitization: The scripts perform basic string conversion and whitespace stripping but do not validate or sanitize the content of the SQL queries or natural language instructions.
[COMMAND_EXECUTION]: The scripts bq_view_lookml_generator.py and create_custom_view.py facilitate the execution of arbitrary SQL queries on the connected database via Looker SDK calls. While this is the intended functionality of the skill, it represents a capability risk as it allows an agent (or an attacker via prompt injection) to perform unauthorized database operations if the Looker connection has excessive permissions.
[DYNAMIC_EXECUTION]: The upload_assets.py script allows the agent to create or update files with arbitrary content in the Looker project. This could be used to inject malicious Javascript for custom visualizations or Looker extensions, which would then execute in the context of a user's browser when they interact with the Looker UI.

lkr-project-helper