The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant surface for indirect prompt injection by ingesting untrusted data that is then used in powerful capabilities without explicit sanitization instructions.
Ingestion points: The agent is instructed to accept user-provided values for SQL statements (taSqlVo.sql), column definitions, data table names, and local file paths across multiple reference files, such as metadata_data_table_sql_write.md and metadata_data_table_download.md.
Boundary markers: The instructions lack boundary markers or specific guidance for the agent to treat embedded instructions in user data as untrusted content.
Capability inventory: The skill utilizes the ae-cli tool which is capable of performing network operations (API gateway communication) and writing to the local file system (metadata data-table download --output <file>).
Sanitization: There are no requirements or steps provided for the agent to validate, escape, or sanitize input before it is passed to shell commands.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands via the ae-cli tool, including operations that interact with the local file system.
Evidence: The metadata data-table download command (documented in references/metadata_data_table_download.md) includes an --output <file> parameter. An attacker could potentially influence the agent to provide a sensitive file path (e.g., ~/.ssh/id_rsa, ~/.bashrc), causing the CLI to overwrite critical system or configuration files.
Evidence: The metadata data-table sql-write command (documented in references/metadata_data_table_sql_write.md) accepts raw SQL strings in the qp JSON object. This allows the agent to construct and execute arbitrary SQL logic on a remote server, which could be abused if the agent incorporates malicious user input into the query structure.

ae-metadata