The Agent Skills Directory

Command Execution: The skill uses subprocess.run to execute local scripts and official utilities such as sqlcmd and the Dataverse CLI. These calls are implemented using list-based arguments to prevent shell injection. Furthermore, the skill avoids exposing credentials by passing passwords through child-process environment variables rather than command-line arguments, and it includes robust redaction logic to strip passwords from logs and error messages.
Indirect Prompt Injection: The skill is designed to ingest data from external ERP SQL tables. While this creates a potential surface for indirect instructions to be processed by the agent, the skill mitigates this by enforcing strict Reader-only roles, implementing column-name filtering to exclude sensitive or secret-like fields, and using a structured IPC protocol that limits available operations to a predefined set of safe actions.
Dynamic Execution: The skill dynamically loads a local authentication helper (auth.py) using Python's importlib. This behavior is limited to specific local paths within the skill's own directory or the user's workspace, representing a standard plugin extensibility pattern rather than a remote code risk.
Secure Local Inter-Process Communication (IPC): For session management, the skill implements a robust IPC layer using Unix-domain sockets or Windows Named Pipes. These are configured with strict current-user-only permissions (DACLs and 0700 modes) to ensure that the session and its associated credentials in memory remain isolated from other users on the system.
Just-In-Time (JIT) Access Governance: The skill follows a meticulous protocol for JIT SQL access, requiring mandatory user-supplied reasons and IP range validation. It performs environment metadata verification before any credential request to ensure the target is a valid development environment.

erp-sql