The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (Parquet, Iceberg, SQL results) through high-privilege tools such as execute_command, write_file, and query_db. While it implements sqlglot for SQL AST validation, the lack of explicit delimiters between data and instructions when using these capabilities creates a surface for indirect prompt injection.
Ingestion points: read_parquet, query_db, read_file, Iceberg snapshots (referenced in SKILL.md and UPGRADE_PLAN_2026.md).
Boundary markers: Absent (no specific delimiters for data vs prompt context).
Capability inventory: execute_command, write_file, query_db, read_database, edit_file (listed in frontmatter).
Sanitization: sqlglot AST validation is mentioned to enforce read-only SELECT and join limits.
[METADATA_POISONING]: The skill uses future-dated documentation (2026) and claims an elaborate industry coalition (including well-known organizations like BlackRock, Salesforce, and Snowflake) to establish trust for an unverified project called "Apache Ossie". This deceptive framing can trick agents and users into lowering their guard for unverified software.
[REMOTE_CODE_EXECUTION]: The skill prepares for and describes "Quack server mode", which is defined as a protocol for remote query execution via HTTP. Additionally, it mentions "quacklake" deployed to Cloudflare Workers with remote query capabilities. The inherent risk of executing code or queries on remote systems is significant, especially when integrated with high-privilege local tools.
[EXTERNAL_DOWNLOADS]: The documentation encourages the installation and use of unverified tools like "Dosi" and "Apache Ossie" interchange formats. These tools are not verifiable standard packages and represent a supply chain risk if an agent or user follows the installation instructions provided in the "Suggested Process".
[COMMAND_EXECUTION]: The skill's allowed-tools include execute_command, which is intended for running analytical scripts in DuckDB and Polars. This high-privilege capability, when combined with the ingestion of external datasets, increases the risk of successful exploitation if malicious instructions are embedded in the data.

analyze-data