The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the orchestrator to extract 'connection info' from user input and save it to a local file named _workspace/00_input.md. This practice leads to the exposure of sensitive credentials, such as database passwords and host details, in plain text within the agent's work environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically database schemas and user-provided files like DDL or ERDs, which creates a surface for indirect prompt injection attacks.
Ingestion points: User-provided connection details and uploaded files (DDL, ERD) processed during Phase 1 and Phase 2.
Boundary markers: The workspace files and ingested schema data lack delimiters or instructions to the agents to disregard or isolate embedded commands.
Capability inventory: The agent team can write to the local filesystem, generate and potentially suggest execution of Python ETL scripts and SQL queries, and perform complex inter-agent messaging.
Sanitization: The workflow does not include any steps to sanitize or validate the content of the technical documents or schema metadata before they are used to influence the team's output.

data-migration