The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to use the cockroach CLI tool for database interactions, specifically using commands like cockroach sql --url "<provided-url>" -e "SQL". A critical security vulnerability exists because the agent is instructed to take a connection URL directly from a user prompt and insert it into this shell command. An attacker could provide a malicious string containing shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands on the host environment.
[CREDENTIALS_UNSAFE]: The skill's primary workflow involves the use of database connection strings (e.g., postgresql://user:password@host...) which often contain sensitive credentials in plaintext. The instructions guide the agent to extract these from user prompts and the COCKROACH_URL environment variable, increasing the risk of credential exposure and misuse within the agent's context.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes and acts upon data returned from the database without sufficient boundaries or sanitization.
Ingestion points: Data entering the agent context includes results from SHOW TABLES, SHOW CREATE TABLE, and general SELECT queries across multiple files (e.g., SKILL.md, references/cockroachdb-rules/05-operational.md).
Boundary markers: Absent. There are no instructions to use delimiters or to treat database output as untrusted content.
Capability inventory: The agent has the ability to execute shell commands, perform database modifications (DML/DDL), and manage user permissions.
Sanitization: Absent. No validation or filtering is applied to database outputs before they are processed by the agent.

cockroachdb-sql