The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill hardcodes a PostgreSQL connection string (PGURL) within SKILL.md that contains a plain-text password (4b14f16c833eff714a7204ef3df53b01) and an administrative username (admin) for a database at 172.245.56.50.
[COMMAND_EXECUTION]: The skill directs the agent to execute administrative commands on a remote server, specifically checking service status via ssh as the root user (ssh root@172.245.56.50). It also performs database queries (psql) against the same external IP using the hardcoded credentials.
[PROMPT_INJECTION]: The skill demonstrates a vulnerability to indirect prompt injection by ingesting untrusted data from external sources.
Ingestion points: The skill retrieves contractor data and website content through web scraping (Apify, Crawl4AI) and database queries (psql).
Boundary markers: There are no boundary markers or instructions provided to the agent to treat external data as untrusted or to ignore embedded instructions.
Capability inventory: The agent is granted extensive capabilities, including shell access (ssh, psql), network operations (curl), and expense tracking tools.
Sanitization: The instructions lack any requirement for sanitizing, validating, or escaping the data fetched from external contractor websites or scraping actors before processing.

rensto-asset