The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from a wide variety of untrusted external sources, creating a significant attack surface for indirect prompt injection.
Ingestion points: The DataLoader class in reference/data-wrangling.md and the load_data function in SKILL.md support parsing over 11 file formats including PDF, PPTX, DOCX, Markdown, and SQL.
Boundary markers: There are no defined boundary markers or instructions to ignore embedded commands within the ingested content.
Capability inventory: The skill possesses the ability to execute database queries (via duckdb and sqlite3), perform filesystem operations, and write telemetry logs to the agent's configuration directory (~/.claude/).
Sanitization: Data cleaning steps are limited to type coercion and basic string normalization, offering no protection against adversarial instructions embedded in the data.
[DYNAMIC_EXECUTION]: The skill provides patterns for executing arbitrary strings as code, specifically SQL queries.
Evidence: The _load_sql method in reference/data-wrangling.md reads the entire content of a file and passes it directly to pd.read_sql. Similarly, query_with_duckdb executes a provided string query on an in-memory database. If the source files or query strings are attacker-controlled, this could lead to unauthorized database operations.
[EXTERNAL_DOWNLOADS]: The skill documentation and implementation patterns depend on a large number of third-party Python libraries for specialized data processing.
Evidence: Dependencies include pandas, polars, pdfplumber, python-pptx, python-docx, plotly, altair, streamlit, duckdb, chardet, tabula-py, numpy, scipy, statsmodels, openpyxl, and xlrd.
[DATA_EXFILTRATION]: The skill includes instructions to emit telemetry to a local sidecar file.
Evidence: SKILL.md instructs the agent to write session outcomes and metrics to ~/.claude/skill-analytics/last-outcome-data-analysis.json. While intended for analytics, writing to a predictable path in the agent's configuration directory could be exploited to monitor or influence agent behavior if the content is manipulated.

data-analysis