The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it extracts labels and question text from untrusted external data sources (SPSS files, CSVs, and spreadsheets) and uses them to populate BigQuery column and table descriptions. These descriptions are explicitly intended to 'teach' and guide downstream LLMs, meaning malicious instructions in the source data could influence agent behavior.
Ingestion points: SKILL.md (Phases 0 and 0.5) describes reading .sav files via pyreadstat and manual parsing of spreadsheets.
Boundary markers: The skill does not implement delimiters or sanitization logic to distinguish between descriptive metadata and potential instructions within the input labels.
Capability inventory: The skill uses google-cloud-bigquery to update table metadata and pyreadstat to parse binary files.
Sanitization: The workflow focuses on structural transformation and value decoding but does not include content validation for the strings used in SchemaField.description.

mandoline