The Agent Skills Directory

[SAFE]: The skill provides documentation and Python templates for data engineering tasks. No malicious patterns such as credential exfiltration, persistence mechanisms, or unauthorized network communication were detected.
[COMMAND_EXECUTION]: Code examples in templates/complete_etl_pipeline.py and references/pipeline-patterns.md utilize string interpolation for SQL schema identifiers (e.g., con.sql(f"INSERT INTO {target_table} ...")). While a common practice for dynamic pipeline generation, this constitutes a potential SQL injection surface if table or column names are derived from untrusted external data without prior validation.
[REMOTE_CODE_EXECUTION]: The skill documentation describes data ingestion surfaces (e.g., pl.scan_parquet and pl.scan_csv) and has the capability to execute database operations via DuckDB. No sanitization of schema identifiers is present in the templates, though parameters are correctly handled using placeholders (e.g., con.sql(query, [source_path, watermark])).

building-data-pipelines