The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of LLM-generated SQL and database query results. It mitigates this risk by providing a mandatory validation workflow in references/query-validation.md.
Ingestion points: SQL output from the ask_question tool and natural language responses from the /api/chat/completions endpoint.
Boundary markers: The skill requires the agent to restate material questions and constraints before execution and provides a structured 'Receipt' format for outcomes.
Capability inventory: The skill uses MCP tools for querying and the requests library for REST interactions.
Sanitization: Explicit instructions are provided to validate SQL grain, joins, and units, and to reject results where material constraints (lineage, status, validity) are substituted or missing.
[CREDENTIALS_UNSAFE]: The skill documentation correctly manages secrets by demonstrating the use of environment variables (os.environ["AUTO_ONTOLOGY_API_TOKEN"]) rather than hardcoding keys. It also notes that the underlying system skips audience (aud) claim verification for SSO tokens, which is a documented architectural property rather than a malicious instruction.
[EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's API endpoints (e.g., ontology.example.com) for term discovery and chat completions. These operations are restricted to data retrieval and do not involve the execution of remote scripts.
[COMMAND_EXECUTION]: The skill instructs the agent to use an MCP server (auto-ontology-mcp), which is a standard and expected interaction for the Auto Ontology environment.

nvidia-ontology-query