The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py executes the sqlmap binary using subprocess.run. It populates command arguments using variables like --url, --param, and --tamper which are sourced from user or agent input.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install sqlmap, a standard open-source utility for SQL injection testing, via pip or apt as a prerequisite.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates a vulnerability surface for indirect prompt injection through the parsing of external tool output.\n
Ingestion points: Standard output from subprocess.run is captured in scripts/agent.py across several functions, including run_detection_scan, enumerate_databases, and enumerate_tables.\n
Boundary markers: There are no explicit markers or instructions used to delimit the external tool output from the agent's context in the returned JSON report.\n
Capability inventory: The skill provides functionality for file reads and OS command execution on the target database server via sqlmap flags, and the wrapper script itself can execute the sqlmap binary.\n
Sanitization: Tool output is processed using string methods to extract database metadata, but the content is not sanitized or escaped before being returned to the agent context.

exploiting-sql-injection-with-sqlmap