The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to fetch and handle the DATABASE_PUBLIC_URL connection string from the Railway environment. This is a high-privilege credential that grants full access to the database instance.
[COMMAND_EXECUTION]: The skill relies on executing multiple shell commands, including railway status, railway service list, railway variable list, and find, to discover the environment and schema. It also recommends running npm install pg to ensure necessary dependencies are present.
[DYNAMIC_EXECUTION]: The skill uses node -e to execute database interaction logic that is constructed at runtime. The agent is instructed to populate a JavaScript template with connection strings and SQL queries, which is then executed in a sub-process.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes untrusted data from multiple sources.
Ingestion points: Data enters the agent's context through railway service list outputs, information_schema query results, and the contents of database rows retrieved via SELECT statements.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers to distinguish between data and instructions when processing database results.
Capability inventory: The skill possesses powerful capabilities including the ability to write to the database (INSERT/UPDATE/DELETE), find files on the local system, and execute arbitrary shell commands.
Sanitization: The skill mitigates SQL injection risks by mandating the use of parameterized queries ($1, $2, etc.), but does not include specific sanitization for potential prompt injection patterns within the retrieved data.

railway-postgres-crud