The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.run to execute database CLI tools like psql, mysql, and sqlcmd. These executions use user-provided inputs for hostnames and credentials, representing a broad surface for command execution.
[CREDENTIALS_UNSAFE]: The agent.py script accepts database passwords via the --admin-password command-line argument. For MySQL and MSSQL, these passwords are then passed as plaintext arguments to the underlying system commands (e.g., -p{password} and -P password), which makes them visible to any user or logging tool monitoring active processes on the machine. This is a significant best-practice violation for secret handling.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external database user tables which could be exploited by an attacker to influence agent behavior if the output is processed by an LLM.
Ingestion points: Database user names and privilege statuses are retrieved in the query_db_users function within scripts/agent.py.
Boundary markers: None; the external data is directly aggregated into a JSON report without delimiters or instruction-blocking warnings.
Capability inventory: The script can execute system commands and write files to the local disk via the --output argument.
Sanitization: None; the raw database output is not sanitized or escaped before inclusion in the final report.
[METADATA_POISONING]: There is a discrepancy between the author name 'mahipal' in SKILL.md and the copyright holder 'mukul975' in the LICENSE file. This inconsistency is misleading regarding the skill's provenance.

implementing-pam-for-database-access