The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's documentation contains Node.js usage examples (Pattern 3: Programmatic Semantic Layer Query) that are vulnerable to command injection. The code uses execSync to interpolate a query variable directly into a shell command: execSync(ktx sl "${query}" --json, ...). If the input for this query comes from an LLM or an untrusted user, it allows for arbitrary command execution on the host machine.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources such as Notion databases, dbt manifests, and local markdown wikis to build a context layer. This creates a large attack surface where malicious instructions embedded in these external documents could influence the agent's behavior when it retrieves that context for querying. Ingestion points include Notion API integration and local file system reads (wiki/ and target/manifest.json). There are no boundary markers or sanitization logic specified to prevent instructions in the data from being interpreted by the agent.\n- [DATA_EXFILTRATION]: The skill enables high-privilege tools for the agent, specifically ktx_query_warehouse, which allows for the execution of SQL queries against connected databases. This capability presents a high risk of sensitive data exfiltration if the agent's prompt context is compromised via direct or indirect injection.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @kaelio/ktx package from the public NPM registry. This introduces a third-party dependency that executes with the same privileges as the user and the agent, which is a common vector for supply chain attacks.

ktx-ai-data-agents-context-layer