The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from external database tables. * Ingestion points: Data enters the agent's context through the output of npx convex data and the processing of exported .jsonl files as described in SKILL.md. * Boundary markers: No delimiters or instructions are used to signal the agent to ignore potentially malicious content within the user data. * Capability inventory: The skill utilizes subprocess calls for npx and sed, providing a path for data-driven command modification. * Sanitization: There is no evidence of sanitization or validation of the retrieved data before it is modified or re-imported.
[DATA_EXFILTRATION]: The skill instructs the agent to export sensitive user, session, and account tables to /tmp/ba-users.jsonl. Files stored in /tmp/ are often world-readable on multi-user systems, posing a risk of exposure for PII and authentication tokens to unauthorized local processes or users.
[COMMAND_EXECUTION]: The workflow includes the use of npx convex import with both --replace and --yes flags. This combination is destructive as it deletes all existing rows in a table before replacement and suppresses the confirmation prompt, which could lead to accidental and irreversible data loss if incorrectly targeted.

convex-better-auth-user-management