The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation for BigQuery queries against production logs (public_core_requestresponselog) explicitly states that the request_header field contains sensitive credentials, including HTTP_CLIENT_ID and HTTP_CLIENT_SECRET. Instructing an agent to access and process fields containing raw secrets poses a significant risk of credential exposure if those headers are returned in responses or logged by the agent.
[COMMAND_EXECUTION]: The skill provides numerous raw SQL query templates and GCP Cloud Logging filter strings for accessing production environments (spotdraft-prod). This grants the agent broad access to query and retrieve sensitive organizational data from production databases and system logs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from contract content and activity logs which could contain malicious instructions.
Ingestion points: Data enters the agent context through the get_contract_content tool, get_contract_activity_log tool, and results from SQL queries targeting contract metadata and text fields.
Boundary markers: The instructions do not specify any delimiters (e.g., XML tags or triple backticks) or "ignore embedded instructions" warnings for the agent when processing this data.
Capability inventory: The agent has the capability to execute arbitrary SQL queries, list production log entries, and call other triage skills, which could be abused if an injection is successful.
Sanitization: There is no evidence of sanitization, escaping, or validation being applied to the contract content or log messages before they are processed by the agent.

contract-lookup