The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to read application configuration files to obtain database credentials.
Evidence: In references/query-examples.md, the command kubectl --context=<ctx-prod> exec -n <namespace> <pod> -- cat /app/dist/src/config/production.config.js is provided to find the host, user, and password.
[COMMAND_EXECUTION]: The skill uses high-privilege kubectl exec commands to interact with remote application pods and execute code.
Evidence: SKILL.md and references/query-examples.md provide templates for running kubectl exec to read sensitive files and execute SQL queries via node -e.
[COMMAND_EXECUTION]: SQL queries are constructed using unsafe string concatenation, which creates a significant risk of SQL injection.
Evidence: SKILL.md states "PgBouncer does NOT support parameterized queries — use inline SQL with quoted values."
Evidence: In scripts/query.js, SQL strings for --describe and --exists are built using string interpolation: sql = SELECT ... WHERE table_name = '${opts.describe}'``.
[DATA_EXFILTRATION]: The skill reads sensitive information, including database credentials and production table data, from a protected cluster environment into the agent's context.
[PROMPT_INJECTION]: The skill has an Indirect Prompt Injection surface where malicious data retrieved from a database could influence agent behavior.
Ingestion points: SQL query results processed in scripts/query.js and references/query-examples.md.
Boundary markers: No delimiters or warnings are used to separate untrusted database content from instructions.
Capability inventory: High-privilege access via Bash tool and kubectl exec.
Sanitization: No evidence of escaping or validation of database content before presentation to the agent.

db-query