The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains a hardcoded database connection string with a plaintext password: postgresql://postgres:simstudio_local_2026@localhost:5433/simstudio.
[COMMAND_EXECUTION]: The skill provides numerous commands to manage local infrastructure using docker compose, including starting/stopping containers and accessing logs at ~/Projects/sim/. It also uses curl to interact with an Admin API using a key stored in a local .env file.
[DYNAMIC_EXECUTION]: The skill instructs the agent to configure Claude Code to use npx -y mcp-remote, which dynamically downloads and executes code from the npm registry to connect to the local Sim Studio instance.
[INDIRECT_PROMPT_INJECTION]: The skill documents several automation patterns that create an attack surface for indirect prompt injection:
Ingestion points: Processes external data via 'Web Search', 'Content Extract', and 'File Upload' nodes in visual workflows (SKILL.md).
Boundary markers: No instructions are provided to the agent to treat external content as untrusted or to use delimiters to prevent instruction injection.
Capability inventory: Workflows have the ability to write to databases, perform network requests via webhooks, and execute transformations (SKILL.md).
Sanitization: There is no evidence of input validation or sanitization before external data is passed to LLM providers within the workflows.

sim-studio