The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it ingests metadata from external systems.
Ingestion points: In SKILL.md, the workflow utilizes posthog:external-data-schemas-list and posthog:execute-sql to read schema metadata, table names, and column descriptions from external databases (e.g., Postgres, MySQL) and SaaS platforms (e.g., Stripe, HubSpot).
Boundary markers: The instructions do not specify the use of delimiters or specific "ignore embedded instructions" warnings for the metadata returned by external tools.
Capability inventory: The skill has access to posthog:execute-sql for data querying and posthog:data-warehouse-source-setup for managing data warehouse connections.
Sanitization: The instructions do not define any sanitization or validation steps for the metadata retrieved from external sources before the agent processes it.
[CREDENTIALS_UNSAFE]: The skill proactively addresses credential safety by instructing the agent to use posthog:data-warehouse-source-connect-link to collect credentials securely in the browser. This prevents users from being prompted to share sensitive passwords or OAuth tokens directly within the chat interface, which is a recognized security best practice.

suggesting-data-imports