The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill identifies the exact location of sensitive configuration files used by the application.
Evidence: C:\\IBM\\SMP\\maximo\\applications\\maximo\\properties\\maximo.properties is listed as a master properties file. This file typically contains database credentials (username, password, and URL) and other system-level secrets in IBM Maximo environments.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external API endpoints, creating a potential attack surface for indirect prompt injection.
Ingestion points: The scripts in gemini.md and gpt.md fetch work order and asset information from external OSLC REST API endpoints.
Boundary markers: The skill does not provide specific instructions or delimiters to mark API data as untrusted or separate from instructions.
Capability inventory: The skill has the capability to perform network requests (requests.get, curl) and access local file paths.
Sanitization: There is no evidence of data sanitization or validation performed on the API responses before they are processed by the agent.
[COMMAND_EXECUTION]: The skill provides commands for high-privilege administrative operations.
Evidence: Commands such as configdb.bat (structural database schema modification) and buildmaximoear.bat (application archive deployment) are included. These commands can significantly modify the state and availability of the enterprise environment.
[PRIVILEGE_ESCALATION]: The skill includes instructions to bypass application-level authorization checks.
Evidence: The Jython script in SKILL.md utilizes the MboConstants.NOACCESSCHECK constant when updating field values, which explicitly instructs the Maximo engine to bypass standard user permission checks for those specific operations.
[DATA_EXFILTRATION]: The skill performs network operations to external domains that are not on the standard whitelist.
Evidence: The scripts interact with https://maximo.enterprise.io. While used as a placeholder, these operations involve sending authentication headers (API keys) to remote infrastructure.

ibm-maximo