The Agent Skills Directory

[COMMAND_EXECUTION]: The Agent Tasks feature allows users to define and schedule tasks that execute arbitrary command-line arguments via the cli_command action type. If an agent is manipulated into creating or modifying these tasks, it could lead to unauthorized command execution on the host running the kbagent serve process.
[REMOTE_CODE_EXECUTION]: The skill supports an ai_agent task type which spawns secondary AI agents (Claude, Codex, or Gemini) with user-provided prompts. The documentation notes that if the environment variable KBAGENT_ALLOW_AI_EXTRA_ARGS is set, these agents can be passed arbitrary flags, potentially allowing an attacker to disable safety filters and achieve unrestricted code execution through the secondary agent.
[DATA_EXFILTRATION]: The skill manages highly sensitive credentials, including Keboola Storage API tokens, Manage API tokens, and internal server tokens. It provides built-in mechanisms to export data from databases to local files, upload files to remote storage, and call external HTTP APIs. This combination of data access and network capabilities creates a significant surface for data exfiltration if the agent's instructions are compromised.
[PROMPT_INJECTION]: The skill exhibits a high surface area for indirect prompt injection (Category 8).
Ingestion points: The skill frequently ingests untrusted data from configuration files, SQL code snippets (transform.sql), Python scripts (code.py), and external Git repositories via the data-app validate-repo and sync pull commands.
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands when the agent processes this external content.
Capability inventory: The skill possesses extensive system capabilities, including file system access, network requests, and the ability to trigger long-running jobs or arbitrary CLI commands.
Sanitization: There is no documented mechanism for sanitizing or escaping the content retrieved from external sources before it is analyzed by the AI or used in prompt construction.

kbagent