The Agent Skills Directory

[PROMPT_INJECTION]: The skill's instructions demonstrate loading data from untrusted external endpoints (e.g., using read_csv on a URL and read_parquet on S3 buckets) directly into the SQL engine. This creates a surface for Indirect Prompt Injection (Category 8), where instructions hidden within the external data could influence or override the agent's behavior.
Ingestion points: Data is fetched from remote locations in multiple code examples within SKILL.md.
Boundary markers: The skill does not provide delimiters or "ignore embedded instructions" warnings to isolate ingested data from the agent's command context.
Capability inventory: The skill utilizes the duckdb library, which can perform file system and network operations.
Sanitization: No evidence of data validation, schema enforcement, or content sanitization is provided in the examples.
[PROMPT_INJECTION]: The included _scores.json file contains a security verdict ("SUSPICIOUS"). This is a self-referential pattern (Category 8e) where the skill's own content makes claims about its security status, which is treated as data to be evaluated rather than an authoritative conclusion.

motherduck