The Agent Skills Directory

[DATA_EXFILTRATION]: The skill allows the agent to execute arbitrary SQL queries against the database, providing access to tables containing sensitive information. This includes the user table (password hashes, OTP secrets) and the site table (cookies, API keys, and tokens). While the systemconfig table is protected by a mandatory --show-secrets flag, other sensitive tables are not similarly gated, allowing an agent to potentially read and then exfiltrate these credentials through other available tools.
[COMMAND_EXECUTION]: The skill uses the execute_command tool to run a local Python script (scripts/mp-db.py) that performs database operations. This script allows for the execution of destructive SQL statements such as DROP, TRUNCATE, and DELETE. Although the instructions recommend user confirmation for such actions, the tool provides the agent with full administrative capabilities over the database.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the database that may contain content from untrusted external sources, such as torrent names, site notes, or metadata, which could serve as a vector for indirect prompt injection.
Ingestion points: Data enters the agent context through the stdout output of scripts/mp-db.py (file: scripts/mp-db.py).
Boundary markers: The skill relies on natural language instructions for safety and does not implement technical delimiters or specific warnings to ignore instructions embedded in the retrieved database content.
Capability inventory: The agent possesses the execute_command capability across all scripts, which could be exploited to perform unauthorized actions if the agent follows malicious instructions found in the data.
Sanitization: The Python script performs structural validation of SQL to prevent multi-statement execution, but it does not sanitize the content of the data retrieved from the database before presenting it to the agent.

database-operation