The Agent Skills Directory

[SAFE]: The skill implements several proactive security measures to ensure safe operation. These include:
Read-Only Enforcement: Database connections are strictly limited to read-only mode using the mode=ro URI parameter for SQLite and SET SESSION READ ONLY for PostgreSQL.
SQL Validation: The utility script performs pre-execution checks on all SQL queries, ensuring they start with allowed read-only keywords (SELECT, WITH, EXPLAIN, etc.) and blocking over 30 dangerous keywords (DROP, DELETE, UPDATE, etc.).
Identifier Escaping: Table and column names are properly quoted or handled using database-specific identifier objects to prevent SQL injection during schema extraction.
[PROMPT_INJECTION]: The skill has an inherent surface for indirect prompt injection because it reads table structures and data from external databases.
Ingestion points: Database schema (table/column names) and sampled data rows are read into the agent's context from scripts/sql_query_helper.py.
Boundary markers: The data is formatted as structured JSON or prefixed text lines, providing some separation, though it lacks explicit instructions to ignore embedded commands.
Capability inventory: The skill only performs read operations; it does not have the capability to write files or perform general network operations.
Sanitization: Database content is not specifically sanitized for instruction-like patterns before being passed to the LLM.
This surface is considered low risk given the read-only nature of the tool and its primary use case for technical SQL assistance.

sql-tutor