The Agent Skills Directory

[SAFE]: The skill provides explicit instructions to prevent HogQL injection by advising the use of type coercion (e.g., int()) and constrained widgets (e.g., st.selectbox) when incorporating user input into database queries.
[SAFE]: The documentation highlights security features of the execution environment, such as the use of generic error messages in the posthog_apps.query() bridge to prevent information leakage and the fact that the sandbox runs as an unprivileged user without access to host environment variables or secrets.
[SAFE]: The skill explicitly states that the sandbox environment does not run package managers like pip at boot, which mitigates risks associated with arbitrary remote code execution or malicious package installation during the app initialization phase.
[INDIRECT_PROMPT_INJECTION]: The skill involves processing user-provided Python source code and HogQL queries for debugging or authoring, which constitutes an indirect injection surface.
Ingestion points: User-supplied application source code and HogQL query strings processed by the agent as described in SKILL.md.
Boundary markers: The skill recommends using generic error handling (RuntimeError) and specific code structures to separate queries from untrusted input.
Capability inventory: The generated application code can perform database queries via the posthog_apps.query() bridge and has access to networking libraries such as requests and aiohttp.
Sanitization: The instructions include mandatory input validation and type enforcement for widget data before it is interpolated into query strings.

writing-streamlit-apps