The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests untrusted user input (database connection details) and uses it to perform operations via the shell and filesystem. This creates a vulnerability surface for indirect prompt injection.
Ingestion points: The SKILL.md file (Turn 1) instructs the agent to ask the user for connection strings, hosts, ports, and usernames.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to treat this user input as untrusted data or to ignore embedded instructions.
Capability inventory: The agent is guided to execute shell commands (psql) and write domain-specific SQL files to the local directory.
Sanitization: There is no requirement for the agent to sanitize or validate the user-supplied connection strings before they are interpolated into shell commands.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that incorporate user-provided connection flags. Specifically, the 'First contact' protocol in SKILL.md directs the agent to run psql -c 'SELECT mz_version();' using connection parameters provided by the user. This presents a command injection risk if the agent does not validate the input, although this functionality is essential for the skill's primary purpose of connecting to a database instance.

mz-demo-data