The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing untrusted data from user-controlled sources within the Looker environment.
Ingestion points: User input enters the system via _filters['view.field'] and parameter_name._parameter_value as described in SKILL.md.
Boundary markers: No specific boundary markers or instructions to disregard embedded commands are included in the logic examples.
Capability inventory: The skill facilitates the generation of dynamic SQL across various parameters including sql, sql_on, and sql_table_name.
Sanitization: Although the skill correctly identifies the risk and recommends the | sql_quote filter, the "Complex Logic" example shows manual string interpolation (${products.brand} = '{{ parts[0] }}') without these safety filters, which could lead to SQL injection if the input is not strictly validated elsewhere.
[DYNAMIC_EXECUTION]: The skill demonstrates how to generate executable SQL code at runtime using Liquid templates.
It utilizes string concatenation and template logic to assemble SQL commands from user-supplied parameters and view definitions.
[DATA_EXFILTRATION]: The skill facilitates access to sensitive user data via the _user_attributes['name'] variable.
This allows user-specific metadata to be included in SQL queries, HTML output, or external links, potentially exposing internal user details if the generated content is accessible to unintended parties.

lookml-liquid