The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides tools (run-sql, run-sqlcl) to execute arbitrary SQL, PL/SQL blocks, and SQLcl-specific commands on the connected Oracle database. This allows for full database control, including data manipulation and schema modification.
[DATA_EXFILTRATION]: The BRIDGE command, detailed in references/data_commands.md, facilitates data movement between databases using JDBC URLs. This functionality can be exploited to exfiltrate data from a secure environment to a remote, external database.
[DATA_EXFILTRATION]: The skill describes several commands that write data to the local file system, such as SPOOL, DATAPUMP EXPORT, APEX EXPORT, and PROJECT EXPORT. These tools provide a mechanism to move sensitive data from the database to files on the host machine.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data directly from the database (e.g., query results, object metadata). Malicious data stored in the database could potentially influence the agent's behavior.
Ingestion points: Results from SQL queries and database object metadata retrieved via run-sql and run-sqlcl tools (referenced in SKILL.md and references/mcp_tools.md).
Boundary markers: Absent. The skill does not define delimiters or provide instructions to the agent to ignore instructions embedded in database outputs.
Capability inventory: The skill has extensive capabilities including file system writes (SPOOL, DATAPUMP, APEX EXPORT), network-based data movement (BRIDGE), and arbitrary code execution within the database context (SQL/PLSQL).
Sanitization: Absent. There is no mention of sanitizing or escaping database output before it is processed by the agent.

sqlcl