The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/extract_block.py executes local git commands via subprocess.run. While it avoids shell execution by passing arguments as a list, the script does not validate the repo, ref, or path parameters, which could allow for command parameter manipulation or reading files outside the target repository via path traversal. Additionally, the skill's procedure includes 'write tests' involving SQL INSERT or UPDATE operations, which are high-privilege actions.
[DATA_EXFILTRATION]: The skill explicitly instructs the agent to query and display real data from database tables. Even with guidance for partial anonymization of identifiers, this process involves bringing potentially sensitive business data into the agent's context and conversation history.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes SQL source code and database outputs that are externally controlled. This presents an attack surface where malicious content embedded in those sources could influence the agent's behavior. Evidence: 1. Ingestion points: SQL blocks from MyBatis XML files and results from database queries. 2. Boundary markers: Absent; the skill does not use specific delimiters or instructions to prevent the agent from obeying instructions embedded in the source code or data. 3. Capability inventory: Capability to execute shell commands (git) and perform database queries. 4. Sanitization: Lacks automated sanitization of ingested content, relying on manual anonymization of identifiers.

sql-walkthrough