The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process metadata from external databases and API definitions, which constitutes an attack surface for indirect prompt injection.
Ingestion points: Metadata is retrieved from database information_schema (tables, columns, types, comments) and OpenAPI/MCP tool definitions as described in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate ingested metadata from the agent's core instructions, making it possible for malicious schema comments to influence agent behavior.
Capability inventory: The skill utilizes shell command execution (via Python scripts) and local file system operations (reading/writing to the .livepowers/ directory).
Sanitization: While the skill claims to skip sensitive data fields (e.g., passwords, SSNs), it does not specify sanitization for the metadata strings themselves, which are the primary injection vector.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute Python scripts located within the plugin directory (scan_sqlite.py, scan_sql.py). These scripts perform file system writes and network-based database queries.
[CREDENTIALS_UNSAFE]: The documentation provides examples of database connection strings (DSN) that include plain-text credentials (e.g., postgres://user:pass@host:5432/db). While used as a template, this encourages the insecure practice of passing secrets as command-line arguments, which can be logged in shell history or visible in process monitors.

env-scan-ontology