The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various untrusted sources, including warehouse tables, user-uploaded CSV files, and external business logic artifacts such as code, spreadsheets, or documents (as seen in playbooks/extract-business-logic.md).
Ingestion points: Untrusted data enters the agent's context through tools like mb query, mb table get, and the WebFetch tool used for fetching business logic artifacts.
Boundary markers: The skill uses instruction-based constraints (e.g., 'read nothing else', 'follow it') and structured JSON delimiters for command inputs, though explicit safety boundary markers for data interpolation are not consistently applied across all playbooks.
Capability inventory: The agent has access to Bash, Write, Edit, and WebFetch, allowing it to execute commands, modify the filesystem, and make network requests based on its analysis of potentially malicious data.
Sanitization: The skill emphasizes using the --json flag and jq for parsing CLI outputs, which helps in structured data handling, but the natural language processing of external documents lacks formal sanitization.
[DYNAMIC_EXECUTION]: The skill dynamically generates an executable bash script (./.scratch/q) to facilitate warehouse queries.
Evidence: In references/state.md, the skill uses cat > ./.scratch/q <<'SH' and chmod +x ./.scratch/q to create and set permissions for a helper script that wraps mb query calls. This script is then executed throughout the playbooks.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to interact with the system and the mb (Metabase) CLI. This includes creating directories (mkdir -p ./.scratch), managing files, and executing complex query commands.
[EXTERNAL_DOWNLOADS]: The skill recommends the installation of external software and scripts.
Evidence: README.md and SKILL.md suggest installing @metabase/cli via npm and adding the skill itself using npx skills add metabase/agent-skills. These resources are provided by the vendor (Metabase) and are documented neutrally.

rde