The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads code from an external GitHub repository at github.com/NikolayS/pgque.git, which is not a recognized trusted source.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute a downloaded SQL file (sql/pgque.sql) into a Postgres database using the psql command. This pattern of downloading and executing scripts from untrusted external sources is a significant security risk.
[COMMAND_EXECUTION]: The skill utilizes shell commands such as git clone, cd, and psql to manage the installation and operation of the queue system, interacting directly with the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes user-provided names and data which are interpolated into SQL commands.
Ingestion points: User-provided inputs for queue names, consumer names, and event payloads (types and JSON data) in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to the agent to treat user data as untrusted or to ignore embedded instructions.
Capability inventory: The skill uses subprocess calls to psql for database interactions and git for repository cloning, providing a mechanism for command and database execution.
Sanitization: The skill lacks sanitization or validation logic to prevent malicious input from being executed as part of the database queries or shell commands.

pgque-postgres-queue