The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the pythia CLI tool (or a local script python scripts/pythia.py) to perform database operations, including snapshots, diffing, and applying changes. It includes specific safeguards, such as forbidding the use of the --yes flag and manual approval commands, ensuring these actions remain under developer control.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a workflow where the agent ingests and relays content generated by the pythia tool (such as DDL diffs, warnings, and impact analysis) into its own context and then to the user. This creates an attack surface where malicious database content or tool output could attempt to influence the agent's behavior.
Ingestion points: Data enters the agent's context from the output of the pythia apply <file> command (specifically diffs, warnings, and the impact: line) as described in step 2 of the workflow.
Boundary markers: The skill implements a robust boundary by requiring a mandatory "Iron Law": no writes occur without human approval. The agent is forced to use an approval card mechanism (pythia approve --card <token>) which requires a human to explicitly click an option in the UI.
Capability inventory: The skill allows the execution of database writes, file system reads (journal history), and general shell command execution through the pythia toolset.
Sanitization: The skill lacks automated sanitization for the tool output, relying instead on the developer's manual verification of the "verbatim" relay of the preview before granting approval.

pythia-apply