The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses string interpolation to build bash commands from user input, specifically the $ARGUMENTS variable in uv run wren --sql '$ARGUMENTS'. This is a command injection vulnerability if the input contains shell-escaping characters like single quotes.
[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to read ~/.wren/connection_info.json, which is a configuration file containing sensitive database credentials including host, username, and plaintext password.
[DATA_EXFILTRATION]: The access to local credential files combined with a command injection vulnerability creates a significant risk where credentials or database content could be exfiltrated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion point: user-provided SQL queries in $ARGUMENTS. 2. Boundary markers: Absent in command construction and instructions. 3. Capability inventory: Bash execution and Read operations. 4. Sanitization: Absent in the provided skill instructions.

wren-query