The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user requests and external API data to generate executable database changesets, which presents a surface for indirect prompt injection.
Ingestion points: The skill ingests natural language descriptions from users (SKILL.md Step 4) and schema/instance metadata from Harness discovery APIs (Steps 1-3).
Boundary markers: The skill lacks explicit boundary delimiters or "ignore instructions" wrappers for the ingested data during prompt interpolation.
Capability inventory: The skill has the capability to trigger remote database authoring pipelines through the harness_execute tool, which applies the generated Liquibase YAML to target environments.
Sanitization: While the skill normalizes usernames (lowercase, alphanumeric filtering), it does not provide formal escaping or sanitization for the Liquibase YAML generated from user inputs.
Mitigation: The risk is significantly mitigated by a mandatory HITL review step (Accept / Deny / Accept & Commit) that requires the user to manually verify the generated code before execution.
[EXTERNAL_DOWNLOADS]: The skill instructions (reference.md) direct the agent to consult official Liquibase documentation at docs.liquibase.com via web search or fetch tools. This reference targets a well-known, authoritative documentation service for a legitimate technical purpose and does not constitute a security risk.
[SAFE]: The skill includes logic to resolve a required conversation_id for pipeline execution by accessing local Cursor IDE transcript metadata (~/.cursor/projects/.../agent-transcripts/). This access is used for functional session management (billing and idempotency keys) and is restricted to metadata relevant to the current agent session.

dbops-changeset