The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill features a significant attack surface for indirect prompt injection by processing raw, external data from database logs.
Evidence: In references/database/analyze-db-postgres.md, the agent is instructed to "analyze the raw recent_logs array thoroughly" (up to 1000 lines) and "Quote actual log lines." This data is untrusted as database logs can contain content generated by external users or attackers, potentially leading to the agent following malicious instructions embedded within the logs.
Evidence: The skill lacks explicit sanitization or filtering instructions for these log lines beyond simple quoting, relying on the model's inherent safety guardrails.
[COMMAND_EXECUTION]: The skill frequently executes system commands to interact with the Railway platform and its databases.
Evidence: The SKILL.md and various files under references/cli/ provide instructions for the agent to run railway CLI subcommands (e.g., up, deploy, status, logs, connect, ssh) and custom management scripts (e.g., scripts/analyze-postgres.py, scripts/extract-railway-cli-help.mjs).
[DATA_EXFILTRATION]: The skill performs discovery operations on sensitive directory paths to assist with authentication setup.
Evidence: In references/database/analyze-db.md, the agent is instructed to run ls ~/.ssh/*.pub 2>/dev/null to list the user's local public keys when SSH connectivity fails. While public keys are intended to be shared, accessing the ~/.ssh directory is a sensitive operation.

run-railway