The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates arbitrary shell command execution through the docker exec utility.
Evidence: The script scripts/db_query.sh wraps docker exec to run sqlite3 commands inside containers. The SKILL.md file also provides examples of running docker exec directly.
Evidence: Documentation in SKILL.md explicitly instructs the agent on how to escalate privileges to the root user within the container using the -u root flag.
[DATA_EXFILTRATION]: The skill provides mechanisms for exposing highly sensitive system-level credentials.
Evidence: reference/common-queries.md and SKILL.md include SQL templates specifically designed to retrieve plaintext credentials. This includes SIP passwords from the m_Sip table and critical system secrets from the m_PbxSettings table, such as SSHPassword, WebAdminLogin, and WebAdminPassword.
[PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection due to its handling of database queries.
Ingestion points: The $QUERY argument in the scripts/db_query.sh script and raw SQL strings in the instructions.
Boundary markers: Absent. There are no instructions or delimiters provided to prevent the agent from obeying instructions embedded in the data it retrieves from the database.
Capability inventory: The skill utilizes docker exec for shell access and sqlite3 for full read/write access to the MikoPBX configuration database, which controls system security settings and firewall rules.
Sanitization: Absent. The scripts/db_query.sh script passes the query string directly to the shell/sqlite3 without any validation or escaping.

sqlite-inspector