The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to read the ~/.duckdbrc file using the cat command. This file is explicitly described in the documentation as containing sensitive database credentials, including the HOST, USER, and PASSWORD for the StarRocks database. Accessing configuration files containing plain-text secrets constitutes a significant data exposure risk as it brings sensitive credentials into the agent's context.
[EXTERNAL_DOWNLOADS]: The skill fetches the DuckDB installation script from https://install.duckdb.org. This is a well-known service for database tooling, and the download is part of the tool's intended setup process.
[REMOTE_CODE_EXECUTION]: The installation process for DuckDB uses a curl | sh pattern, which pipes a remote script directly into the system shell. This pattern facilitates the execution of code downloaded at runtime.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to perform its core functions, including duckdb -c to run SQL queries, cat to verify configuration files, and head or wc to inspect processed CSV data.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface through the interpolation of user-supplied data into SQL queries and shell commands.
Ingestion points: User input is used for SQL keyword filtering (<keyword>) and for providing database connection details if the configuration file is missing.
Boundary markers: Absent. The SQL templates and bash commands do not utilize parameterization or delimiters to isolate user-provided content from the command logic.
Capability inventory: The skill has the capability to execute shell commands (duckdb -c, cat, head, wc) and write to the local file system via CSV exports.
Sanitization: Absent. There is no logic provided to sanitize or escape user-controlled strings before they are interpolated into executable shell commands or SQL statements.

agilecdn-billing-query