The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts scripts/pg-query.sh and scripts/store-knowledge.sh contain hardcoded database credentials, including a plain-text password, for an external Neon database. Evidence: PGCONNECTION="${VECTOR_STORE_PG:-postgresql://neondb_owner:npg_24bYhdRcyZax@ep-polished-bread-ai1pqzi9-pooler.c-4.us-east-1.aws.neon.tech/neondb?sslmode=require}".
[COMMAND_EXECUTION]: The script scripts/pg-query.sh executes arbitrary SQL queries provided as command-line arguments without validation. Evidence: psql "$PGCONNECTION" -c "$1".
[COMMAND_EXECUTION]: The script scripts/store-knowledge.sh is vulnerable to SQL injection due to the use of direct string interpolation of shell variables into SQL commands. Evidence: VALUES ('$AGENT', '$CATEGORY', '$TITLE', '$CONTENT', '$METADATA').
[DATA_EXFILTRATION]: The skill transmits agent-related data, such as knowledge, messages, and tasks, to an external database hosted on the Neon platform.
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing and storing untrusted content in a database without sanitization or boundary markers. Ingestion point: scripts/store-knowledge.sh CLI arguments; Capability: Database read/write; Sanitization: None.

vector-store