The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it instructs the agent to read and analyze raw SQL queries from the query_log_archive table, which can contain data from untrusted users or other AI agents.
Ingestion points: Untrusted data enters the context through the query and lc_query__query columns in posthog.query_log_archive as described in SKILL.md and references/hogql-deep-dive.md.
Boundary markers: There are no instructions to use boundary markers or to ignore potential instructions embedded in the analyzed SQL (e.g., within SQL comments).
Capability inventory: The skill uses the hogli tool for database queries, writes files to the local file system or a sibling repository, and spawns background sub-agents using the Agent tool for code research.
Sanitization: While references/query-patterns.md includes a _ch_literal function to escape single quotes in Metabase URLs to prevent injection at the tool level, there is no general sanitization for the content processed by the LLM.
[DATA_EXFILTRATION]: The skill facilitates access to sensitive operational data, including full query logs, team IDs, and API key labels via the posthog.query_log_archive table. While these are internal vendor resources, the exposure level for this data is significant during the reporting process.
[COMMAND_EXECUTION]: The methodology involves the use of the Agent tool to spawn background sub-agents. These sub-agents are tasked with exploring and reading the PostHog source code repository to ground recommendations, which represents a form of dynamic agentic execution triggered by findings in external log data.

generating-clickhouse-query-performance-reports