The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit defensive instructions to protect the agent from malicious payloads embedded in metadata. It directs the agent to treat event names, property values, and free-text descriptions from the data catalog as quoted, untrusted data rather than as instructions or authorization for tool execution.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where instructions could be injected via external data sources.
Ingestion points: The agent reads schema and metadata through information_schema, read-data-schema, and system.information_schema.metrics (specifically the description and instructions fields within the metric definitions).
Boundary markers: Instructions within the skill act as a logical boundary, requiring the agent to treat the ingested data as non-executable content and "quoted data."
Capability inventory: The agent has access to powerful tools including posthog:view-create, posthog:view-update, posthog:view-materialize, and posthog:execute-sql which can modify the warehouse state.
Sanitization: The skill mandates a human-in-the-loop checkpoint, requiring the agent to confirm the specific events and properties it intends to use with the user before performing any persistent write operations.

modeling-warehouse-foundations