The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/snowman.py to execute the Snowflake CLI (snow) via subprocess.run. This is the primary mechanism for querying databases and discovering account metadata. The execution is restricted to the snow binary and does not use a shell wrapper.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data and schema metadata from Snowflake databases.
Ingestion points: Data and metadata returned by snow sql in scripts/snowman.py.
Boundary markers: System notes, types, and truncation warnings are prefixed with # on stderr to distinguish them from query results.
Capability inventory: The skill can execute SQL (via the wrapper), write local files (staged scripts and result artifacts), and read local configuration files.
Sanitization: A lexical filter (enforce_read_only in scripts/snowman.py) checks for destructive SQL keywords and multiple statements before execution.
[DYNAMIC_EXECUTION]: The stage function in scripts/snowman.py generates SQL files based on user-provided input. These files are saved to the .snowman/staged/ directory for manual review and execution by the user, providing a safety buffer for data-modifying operations.

snowman