The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script via the shell, incorporating a user-provided file path as an argument. This pattern introduces a risk of command injection if the agent fails to sanitize the file path before execution. Evidence: The SKILL.md file contains the instruction python scripts/validate_schema.py <path_to_user_file>.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from user-provided files and reflects portions of that data back to the agent via error messages. Ingestion points: The scripts/validate_schema.py script reads the entire content of the user-specified file path. Boundary markers: No delimiters or specific instructions are provided to the agent to distinguish the script's output from potential embedded instructions. Capability inventory: The agent uses the run_command tool to execute the validation script and interprets its stdout. Sanitization: The validation script extracts table names using regular expressions and includes them directly in output strings (e.g., f"ERROR: Table '{table_name}' must be snake_case."). A malicious actor could craft a file with a table name that contains instructions intended to hijack the agent's execution flow when the agent reads the resulting error message.

database-schema-validator