The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements tools such as executeQuery and executeUpdate that facilitate the execution of arbitrary SQL statements on a target database. While this is the intended purpose, it grants the agent extensive capabilities that could be misused if the agent is compromised or misled.
[COMMAND_EXECUTION]: The Java code example provided for extending the skill (countRows tool) contains a SQL injection vulnerability. It directly concatenates the table input parameter into a SQL string: "SELECT COUNT(*) FROM " + table. This allows for query manipulation if the agent provides a crafted table name.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a surface for indirect prompt injection by ingesting data from external databases (via listTables, describeTable, executeQuery).
Ingestion points: Data retrieved from database tables, schemas, and query results.
Boundary markers: None observed in the implementation examples.
Capability inventory: Execution of arbitrary SQL (read and write), network connection attempts to user-defined hosts.
Sanitization: No evidence of input sanitization or parameterized queries for metadata-based tools like the countRows example.
[CREDENTIALS_UNSAFE]: The architecture requires the AI agent to pass database username and password as plain-text arguments for every tool invocation. This practice exposes sensitive credentials in the agent's interaction logs, memory, and network traffic between the agent and the MCP server.
[EXTERNAL_DOWNLOADS]: The installation instructions direct the user to clone source code from an external repository (https://github.com/PerfectXM/mcp-db-server.git). This involves downloading and executing code from a remote source that is not part of the primary vendor infrastructure.

mcp-db-server-stateless