The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the SAPQuery tool which supports SAP_ALLOW_FREE_SQL for 'freestyle SQL'. This allows the agent to construct and execute arbitrary SQL queries against the SAP database based on user-provided inputs.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through several vectors:
- Ingestion points: The skill accepts untrusted data including OData URLs (copied from browser DevTools), object names, and filter values in the 'Inputs' section.
- Boundary markers: There are no explicit instructions or delimiters to isolate user-provided data from the command structure in SAPQuery or SAPDiagnose calls.
- Capability inventory: The skill has powerful capabilities including SAPQuery (database reads), SAPDiagnose(action="trace_start") (system state modification), and SAPDiagnose(action="set_sql_trace_state") (authorization-heavy operations).
- Sanitization: There is no mention of escaping, validating, or sanitizing the 'real filter values' before they are interpolated into SQL strings for SAPQuery.
[DYNAMIC_EXECUTION]: The skill uses SAPDiagnose to dynamically arm and disarm ABAP profiler traces and ST05 SQL traces. It also generates and executes SQL at runtime to analyze table indexes and metadata (e.g., querying DD12L).
[PRIVILEGE_ESCALATION]: The skill explicitly documents the need for sensitive SAP authorizations such as SAP_ALLOW_WRITES and S_ADT_RES to perform trace operations. While these are necessary for the skill's function, they represent a significant permission set that could be abused if the agent is compromised.

debug-slow-sql