The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3, npx, and databricks CLI commands to perform its operations. These are standard tools within the Databricks development ecosystem and are used for legitimate automation tasks like contract validation, type generation, and app deployment.
[REMOTE_CODE_EXECUTION]: The skill executes npx @databricks/appkit generate-types. This is a tool provided by a well-known service (Databricks) and is the official method for generating TypeScript definitions from a warehouse. Per security guidelines, downloads and execution from well-known services are considered safe.
[PERSISTENCE_MECHANISMS]: The skill provides instructions for gating drift in CI/CD pipelines (e.g., GitHub Actions, GitLab CI). This is a standard security practice to ensure that the code running in production matches the governed source contract and is not a persistence mechanism for malicious code.
[DATA_EXPOSURE]: The skill specifically addresses data exposure risks by enforcing the .obo.sql (On-Behalf-Of) suffix. It prevents developers from accidentally converting per-user queries into service-principal queries, which would otherwise lead to unauthorized data access via shared caches.
[OBFUSCATION]: Analysis of the Python script materialize_app.py and the Markdown documentation shows no signs of Base64 encoding, zero-width characters, or homoglyph attacks. The logic is clear and focused on file integrity and validation.
[SAFE]: The materialize_app.py script includes defensive programming practices, such as safe_rel() to prevent path traversal attacks when reading the manifest, reject_symlinks() to prevent following links outside the managed directory, and strict SHA-256 verification of all governed files.

report-to-databricks-app