The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes a potential attack surface where the agent could be manipulated into executing malicious SQL commands while performing query optimization or debugging tasks.
Ingestion points: The utility script scripts/sql_helper.py accepts raw SQL strings through methods such as execute_with_timing and explain_query. These strings could originate from untrusted user-provided files or data ingested during the agent's interaction.
Boundary markers: There are no explicit boundaries or 'ignore embedded instructions' warnings implemented within the sql_helper.py script to separate command structure from potentially malicious data markers.
Capability inventory: The DatabaseHelper class in scripts/sql_helper.py utilizes the sqlalchemy library to provide full database interaction capabilities, including connecting to remote servers, executing DML/DDL commands, and retrieving sensitive table information.
Sanitization: While the script supports and encourages the use of parameterized queries, it allows for the execution of raw string-formatted SQL, which does not inherently sanitize against injection if the agent interpolates untrusted data directly into the query string before execution.
[EXTERNAL_DOWNLOADS]: The skill's documentation (README.md and SKILL.md) recommends the installation of standard database drivers and libraries to enable connectivity.
Evidence: Instructions include pip install commands for psycopg2-binary (PostgreSQL), mysql-connector-python (MySQL), pyodbc (SQL Server), and sqlalchemy (ORM). These are widely recognized and established tools within the Python ecosystem for database operations.

sql-expert