The Agent Skills Directory

[COMMAND_EXECUTION]: The file templates/streamlit_app.py provides a 'Run Custom Query' feature that accepts raw input from a Streamlit st.text_area and executes it directly against the Snowflake database using session.sql(query). This allows any user of the deployed application to execute arbitrary SQL commands with the privileges of the application's owner or caller.
[INDIRECT_PROMPT_INJECTION]: The skill templates establish an attack surface by ingesting untrusted user input into database commands.
Ingestion points: User inputs via st.text_input in templates/pages/data_explorer.py and st.text_area in templates/streamlit_app.py are used to construct SQL queries.
Boundary markers: The templates do not implement boundary markers or instructions to prevent the execution of malicious commands embedded within the user input.
Capability inventory: The application context has the capability to execute arbitrary SQL queries (session.sql), which can be used to modify, delete, or exfiltrate data depending on the assigned Snowflake role.
Sanitization: While templates/pages/data_explorer.py includes regex validation and identifier quoting logic, the primary entry point templates/streamlit_app.py provides no sanitization for its custom query interface.
[DATA_EXPOSURE]: The GitHub Actions workflow defined in references/ci-cd.md implements a pattern where the SNOWFLAKE_PRIVATE_KEY secret is written to a temporary file at /tmp/rsa_key.p8. Although common in CI/CD environments, this practice leaves sensitive credentials on the runner's disk for the duration of the job.

streamlit-snowflake