The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from external database tables, schema metadata, and graph relationships which could contain malicious instructions.
Ingestion points: Data enters the agent context via MCP tools such as read_table_rows, list_tables, discover_graph_schema, and get_graph_configuration (defined in references/mcp-tool-contract.md).
Boundary markers: The instructions in SKILL.md command the agent to resolve project boundaries and resolution modes, but there are no explicit technical delimiters or escaping mechanisms defined for the ingested data.
Capability inventory: The underlying MCP toolset includes write operations such as upsert_row, create_context_collection, and build_graph. Although SKILL.md explicitly forbids mutation ("This skill must not mutate a project") and mandates read-only behavior, the presence of these tools in the environment creates a theoretical path for exploitation if the agent is subverted by malicious data.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from the database before it is used to formulate design recommendations.

polygres-retrieval-design