The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute a local Python script scripts/sql_query_helper.py using python3 to interact with databases.
[EXTERNAL_DOWNLOADS]: The documentation explicitly recommends the installation of the psycopg2-binary package from the standard PyPI registry to enable PostgreSQL support.
[CREDENTIALS_UNSAFE]: The --dsn parameter for PostgreSQL connections is designed to accept connection strings (e.g., host=localhost dbname=mydb user=reader) which frequently contain sensitive credentials like usernames and passwords in plaintext.
[DATA_EXFILTRATION]: The skill's schema command extracts database structures, metadata, and sample rows. While this is its intended purpose, it establishes a mechanism for the agent to access and potentially leak sensitive information stored in local or remote databases.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external database sources and incorporates it into the agent's context for query translation and analysis.
Ingestion points: Database schemas, table names, column definitions, and sample row data are fetched from the database by scripts/sql_query_helper.py.
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions to prevent the agent from obeying malicious instructions embedded within database content.
Capability inventory: The skill has the capability to read local files (SQLite) and perform network operations to remote databases (PostgreSQL).
Sanitization: While the input SQL is validated against a keyword blocklist, the data retrieved from the database (which constitutes the context injection surface) is not sanitized or escaped before being provided to the agent.

sql-insight