The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell script templates that execute the psql utility with direct variable interpolation. Specifically, the tsdb_query helper function and associated scripts use variables like $HYPERTABLE within SQL strings (e.g., WHERE hypertable_name = '$HYPERTABLE'). This creates a risk of SQL injection if an attacker provides a hypertable name containing malicious SQL commands (e.g., mytable'; DROP TABLE users; --).
[DATA_EXFILTRATION]: The skill accesses sensitive database configuration and data samples using the $TIMESCALE_URI environment variable, which typically contains connection credentials. The instructions mandate multi-phase discovery that reveals internal schema details, compression settings, and sample records, which are then outputted to the agent's context.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from the database (via psql output) and processes it without sanitization or explicit boundary markers. If a database contains malicious content in hypertable names or column metadata, it could influence the agent's subsequent reasoning and actions.

analyzing-timescaledb