The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Node.js script (query.mjs) via shell commands. User-supplied parameters, such as index names (<name>) and task IDs (<id>), are interpolated directly into the command string. If the agent does not properly sanitize these inputs, it could lead to command injection vulnerabilities where a user executes arbitrary shell commands on the host system.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display data from external Meilisearch instances, such as task details and index settings. This represents an attack surface where malicious content stored within the database (e.g., a specially crafted task error message or index metadata) could attempt to influence the agent's behavior when retrieved and processed.- [DATA_EXPOSURE]: The skill provides tools to inspect sensitive index settings and task logs. While it uses environment variables for authentication, users with access to this skill could potentially exfiltrate configuration details or internal data structures from the Meilisearch instance.

meilisearch-admin