The Agent Skills Directory

[COMMAND_EXECUTION]: The retrieveRelevant function in SKILL.md contains a potential SQL injection vulnerability where the topK parameter is directly interpolated into a database query string: SELECT TOP ${topK} .... In a production environment, if this parameter is derived from untrusted user input, it could allow an attacker to manipulate the query logic.
[INDIRECT_PROMPT_INJECTION]: The skill's code examples ingest external data and interpolate it directly into LLM prompt templates, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill processes req.data.question and req.data.context within the AssistantService and LangChain examples in SKILL.md.
Boundary markers: No delimiters or "ignore instructions" warnings are implemented in the provided prompt templates.
Capability inventory: The skill demonstrates capabilities for database reads (cds.db.run), database writes (INSERT.into), and network requests to AI foundation models (client.invoke).
Sanitization: While the "Common mistakes" section warns against sending raw user input to the LLM, the provided code snippets do not implement sanitization or validation logic.
[EXTERNAL_DOWNLOADS]: The skill references and installs several packages from the @sap-ai-sdk namespace on NPM. These are official SDKs from SAP, which is a well-known service provider, used for integrating with SAP AI Core infrastructure.

cap-llm-plugin