The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted metadata from experiment and feature flag records, which could potentially contain malicious instructions.
Ingestion points: Data is ingested from the system.experiments and system.feature_flags tables (Step 1a and 1b) which contain user-controlled strings like experiment names and variant keys.
Boundary markers: The instructions do not define delimiters or explicit boundary markers to isolate this external data when it is interpolated into the agent's context for analysis.
Capability inventory: The skill utilizes powerful capabilities including execute-sql, query-session-recordings-list, and experiment-get which could be influenced by injected instructions.
Sanitization: No specific sanitization or validation steps are provided for the metadata retrieved from the platform before the agent processes it.
[DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically assemble and execute database queries using template strings.
Evidence: Step 1a and 1b in SKILL.md provide HogQL templates where the agent is expected to insert variables such as <experiment_id> and <feature_flag_key>. While standard for analytical tools, this dynamic code generation relies on the agent's safe handling of variable interpolation.

analyzing-experiment-session-replays