The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it facilitates the ingestion of untrusted database schema and row data.
Ingestion points: The agent reads data via queryPgDatabase (documented in SKILL.md and references/app-workflow.md).
Boundary markers: No explicit delimiters or instructions are used to separate database content from agent instructions.
Capability inventory: The agent has capabilities to execute SQL commands via managePgDatabase, modify environment configurations with manageEnv, and manage authentication via manageAppAuth.
Sanitization: There are no explicit instructions for sanitizing or escaping data retrieved from the database before it is processed by the agent.
[COMMAND_EXECUTION]: Provides patterns for dynamic SQL execution using anonymous code blocks (DO $$ BEGIN EXECUTE ...) in references/troubleshooting.md. This is suggested as a workaround for transient DDL errors and represents a form of dynamic statement assembly.
[CREDENTIALS_UNSAFE]: The skill's documentation contains detailed instructions for managing authentication keys and session tokens. It includes critical safety warnings correctly advising developers to never expose the service_role API Key in frontend code and to restrict its use to trusted server-side environments.

postgresql-development-cloudbase