The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes telemetry data containing $mcp_intent strings, which are free-text values written by customer agents. This represents an indirect prompt injection surface.
Ingestion points: The SQL query in SKILL.md (specifically the opening field) fetches untrusted text from ClickHouse.
Boundary markers: The skill relies on explicit instructions to the agent to treat input as data to be classified rather than instructions to follow, as no fixed delimiters are used in the raw telemetry concatenation.
Capability inventory: The agent possesses the execute-sql tool, PostHog notebook assembly tools, and shell access for running the included Python scripts.
Sanitization: The skill uses regex matching in ClickHouse to sanitize caller and org identifiers before they reach Python code. For intent text, it recommends using the isolated scripts/extract_facets.py to prevent data from reaching agent actions.
[COMMAND_EXECUTION]: The skill documentation provides instructions for the agent or user to execute local Python scripts (extract_facets.py, canonicalize_intentions.py, audit_intentions.py) and shell commands using the 1Password CLI (op read) for secret management.
[DATA_EXFILTRATION]: The skill's scripts send customer-authored telemetry text to the OpenAI API for extraction and embedding generation. The documentation includes mandatory privacy controls, such as verifying the is_ai_data_processing_approved flag for organizations and instructions to generalize goals to strip PII.

exploring-mcp-tool-original-user-motive