The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill suggests the installation of additional capabilities from an external source using the command npx skills add https://github.com/insforge/agent-skills. This repository belongs to an organization that is not recognized as a trusted or well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted user input to generate structured database code (DDL) and migrations.
Ingestion points: Discovery questions in SKILL.md where the user defines multi-tenancy and data structure requirements.
Boundary markers: The skill does not define specific delimiters or instructions to ignore malicious commands embedded within user-supplied names or requirements.
Capability inventory: The skill produces DDL, indexes, and migration files intended for execution by the agent or host CLI tools (such as supabase, drizzle, or insforge-cli).
Sanitization: There is no evidence of sanitization or validation for user-provided identifiers (like table names or column names) before they are interpolated into the generated schema code.

data-modeling