The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install and execute the @insforge/mcp package directly from NPM using npx -y @insforge/mcp@latest. Executing unpinned remote code at runtime poses a risk of supply chain attacks or version instability.
[COMMAND_EXECUTION]: The documentation provides multiple Bash command templates for the agent to execute, including configuring MCP servers (claude mcp add), testing API connectivity via curl, and running complex shell scripts to generate and sign JWTs using openssl. These operations involve high-privilege access to the user's environment.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive database credentials, such as SUPABASE_SERVICE_ROLE_KEY and InsForge admin API keys, which bypass Row Level Security (RLS). While it provides best-practice guidance for secret management (using .env.example and .gitignore), the instructions involve the agent directly handling and verifying these secrets in the shell.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by processing external platform instructions and user-provided configuration without explicit boundary markers or sanitization.
Ingestion points: Instructions in SKILL.md and references/insforge.md guide the agent to interpret data from external BaaS platforms and environment variables.
Boundary markers: Absent; no delimiters or warnings are used to distinguish instructions from external data.
Capability inventory: The agent is granted Bash, Write, Read, and Edit tools, allowing for command execution and file modification based on ingested data.
Sanitization: No evidence of input validation or escaping is present for variables interpolated into shell commands or SQL scripts.

postgrest-baas-builder