The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill documentation explicitly describes an 'Execution Context' (context: { isSystem: true }) as a 'system-read escape hatch' intended to bypass standard RLS scoping.
Evidence: In SKILL.md, the documentation explains that passing { isSystem: true } allows the engine to return data that would otherwise be filtered out by organizational or permission-based scoping. If an attacker can influence the agent to include this context in a query, they could achieve unauthorized data access.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the translation of natural language into structured ObjectQL queries, creating a surface for query injection.
Ingestion points: Untrusted user input is expected to be used to populate where filters, search terms, and groupBy fields across various files (SKILL.md, rules/filters.md).
Boundary markers: The documentation lacks specific instructions for the agent to use delimiters or sanitization logic when interpolating user data into the DSL structure.
Capability inventory: The skill provides extensive data retrieval capabilities, including relation expansion (expand) and complex aggregations, which could be abused to exfiltrate data through unauthorized relations.
Sanitization: While the objectstack engine performs validation, the agent's construction phase is a potential failure point where user input could be misinterpreted as query operators (e.g., $field or $or).
[COMMAND_EXECUTION]: The documentation instructs the user to run CLI commands to verify their work.
Evidence: SKILL.md suggests executing os validate and os build to verify schema and dataset bindings. While presented as developer guidance, these involve shell command execution.

objectstack-query