The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Several templates in the skill process untrusted data which is subsequently included in prompts sent to Large Language Models (LLMs). Specifically, templates/text2sql.py uses user questions to generate SQL, while templates/rag.py and templates/memory_lib.py interpolate database retrieval results into generation prompts.
Ingestion points: User input is captured via input() in interactive templates, and external data enters the context through database search results (table.search()).
Boundary markers: The prompts use basic text delimiters (e.g., "---------------------" in the RAG template) but lack robust instruction-isolation mechanisms.
Capability inventory: The skill possesses the capability to execute SQL queries (db.query) and write to the database (table.insert, table.bulk_insert).
Sanitization: The Text2SQL template implements a is_readonly_sql check to block non-SELECT statements and requires explicit user confirmation (confirm = input(...)) before executing generated queries.
[COMMAND_EXECUTION]: The templates/text2sql.py template is designed to execute SQL commands dynamically generated by an LLM. Although the template includes a read-only keyword filter and a human-in-the-loop confirmation step, the execution of model-generated code constitutes a known security risk if the filtering logic is bypassed or if users are tricked into approving malicious queries.

pytidb