The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted user descriptions to generate and execute shell commands. A malicious user could craft a description that causes the agent to generate a query containing shell metacharacters or unauthorized file paths.
Ingestion points: User-provided descriptions of visualizations used as the primary input for query generation as described in the argument-hint and instructions in SKILL.md.
Boundary markers: Absent; the skill lacks instructions for the agent to ignore or escape embedded instructions within user descriptions.
Capability inventory: The skill has the capability to execute shell commands via the Bash tool and can read from arbitrary file paths using the FROM clause in its query syntax.
Sanitization: There are no instructions for validating or sanitizing the generated query strings before they are passed to the CLI tool.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to use the Bash tool to run the ggsql CLI utility. The pattern ggsql exec "<query>" is provided in the instructions, which relies on shell quoting that can be bypassed if the user-influenced <query> string contains certain shell metacharacters.
[EXTERNAL_DOWNLOADS]: The skill references external documentation at https://ggsql.org/syntax/index.llms.md. This is a reference to the official documentation for the ggsql tool and is documented here as an external resource.

ggsql