The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of the sqlmap command-line utility to perform its core functions. It provides numerous examples of how to invoke the tool with various flags that interact with external systems.
Evidence: Multiple examples throughout the document, such as sqlmap -u "http://target.com/page.php?id=1" --batch and sqlmap -r /path/to/request.txt --dbs --batch.
[REMOTE_CODE_EXECUTION]: The skill explicitly documents how to use SQLMap to gain remote command execution and interactive shell access on the target database server.
Evidence: Example 6 lists commands for --os-shell (interactive shell) and --os-cmd="whoami" (executing specific commands).
[DATA_EXFILTRATION]: The skill provides instructions for extracting sensitive information from databases, including entire table dumps and reading arbitrary files from the remote server's file system.
Evidence: Use of the --dump, --dump-all, and --file-read="/etc/passwd" flags.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could be crafted to influence the agent's execution flow or the tool's behavior.
Ingestion points: Target URLs, HTTP request files (-r), log files (-l), and bulk URL files (-m).
Boundary markers: The skill includes a 'Mandatory confirmation gate' and 'Operational Boundaries' in the markdown text to guide the agent, though these are not programmatically enforced.
Capability inventory: The skill utilizes shell command execution, network operations, remote file reads/writes, and remote code execution.
Sanitization: No specific sanitization or validation logic is provided for the external inputs before they are passed to the sqlmap command.

sqlmap-database-pentesting