The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: All scripts utilize npx to fetch and execute the @toolbox-sdk/server@1.1.0 package from the NPM registry during every invocation. This creates a mandatory runtime dependency on an external package registry and a third-party package.- [REMOTE_CODE_EXECUTION]: The runtime fetching and execution of the @toolbox-sdk/server package via npx is a form of remote code execution.- [COMMAND_EXECUTION]: The skill uses child_process.spawn to execute shell commands to perform its core functions. On Windows, it uses shell: true, which requires careful argument handling to prevent injection.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and displays data directly from the Oracle database without sanitization or boundary markers. 1. Ingestion points: Results from SQL queries and database metadata (e.g., in list_active_sessions.js, list_tables.js). 2. Boundary markers: None present to distinguish database data from agent instructions. 3. Capability inventory: The skill can execute shell commands via npx. 4. Sanitization: No sanitization is performed on data retrieved from the database before it is returned to the agent.

oracledb