The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an architectural pattern where untrusted data is ingested from a Kafka-based Change Data Capture stream and subsequently applied to a target system. This constitutes a potential vulnerability surface for indirect prompt injection if the ingested data is not strictly validated.
Ingestion points: Events are consumed from the database.changes Kafka topic in SKILL.md.
Boundary markers: The processing logic lacks explicit boundary markers or instructions to disregard embedded commands in the data stream.
Capability inventory: The skill includes functions for database write operations (via MongoClient), network egress (via Slack and Grafana APIs), and local file system logging.
Sanitization: While the code uses json.loads to decode events, there is no evidence of schema validation or sanitization of the payload contents before execution or application to the target database.
[DATA_EXFILTRATION]: The skill implements logic to transmit monitoring data and alerts to external endpoints, including Slack webhooks and the Grafana dashboard API. While these are common operational tools, the presence of network POST capabilities combined with database access creates a vector for data exfiltration if the alerting triggers are compromised or misconfigured.
[EXTERNAL_DOWNLOADS]: The implementation templates depend on several third-party libraries that would need to be installed in the agent's environment. Users should verify these dependencies to prevent supply chain attacks.
Node.js packages: mongodb, winston, prom-client.
Python packages: kafka-python, prometheus-client, numpy, requests.

database-migrations-migration-observability