The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the cockroach CLI tool.
It specifically directs the agent to run cockroach sql --url "<provided-url>" -e "SQL". This pattern interpolates user-provided connection strings directly into a shell command. If the input contains command substitution characters like backticks or $(...), it could lead to arbitrary command execution on the host system.
The skill also uses echo $COCKROACH_URL to retrieve environment variables, which is a form of shell command execution to access system state.
[DATA_EXFILTRATION]: The skill identifies and accesses potentially sensitive data sources.
It attempts to read the COCKROACH_URL environment variable, which typically contains sensitive database credentials and connection parameters.
The skill is designed to execute SQL queries (including data retrieval) and display the results, which could be used to exfiltrate database contents if the agent is directed to do so by a malicious prompt.
[PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection attacks.
Ingestion points: The skill accepts natural language prompts and database connection strings (URLs) directly from the user environment or conversation history (found in SKILL.md).
Boundary markers: There are no instructions or delimiters provided to the agent to treat user-supplied URLs or SQL queries as untrusted data or to prevent them from breaking out of the shell command context.
Capability inventory: The agent is granted the capability to execute shell commands (cockroach sql) and interact with remote databases (found in SKILL.md).
Sanitization: The instructions lack any requirement for the agent to sanitize or validate the provided-url or the generated SQL before passing them to the shell execution environment.

cockroachdb-sql