The Agent Skills Directory

[Indirect Prompt Injection] (LOW): SQL Injection vulnerability detected in templates/usage_monitoring.py due to unsafe string interpolation. 1. Ingestion points: share_name and days parameters in the get_share_usage method. 2. Boundary markers: None present; user-provided strings are directly wrapped in single quotes within the SQL query. 3. Capability inventory: The function generates SQL strings intended for execution against Databricks system tables (system.access.table_lineage). 4. Sanitization: None; the code uses f-string interpolation instead of parameterized queries.
[Data Exposure & Exfiltration] (LOW): Exposure of sensitive activation credentials. Evidence: examples/external_data_sharing.py prints recipient.activation_url to the console. This URL provides direct access to download the Delta Sharing credential file (bearer token), which should be handled as a secret to prevent unauthorized data access.

delta-sharing