The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill provides explicit instructions and examples for the agent to use the sqlite3 CLI to interact with a database file. This allows for arbitrary SQL execution, which can be leveraged to read, write, or delete files on the host system using SQLite meta-commands (e.g., .output, .import, or ATTACH DATABASE).
[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: The skill reads data from the influencers table in influencers.db, specifically fields like recent_activity, notes, and rationale (found in SKILL.md).
Boundary markers: There are no instructions or delimiters defined to help the agent distinguish between data and embedded commands within these fields.
Capability inventory: The agent has full read/write access to the local database via sqlite3 CLI, as documented in the 'Using sqlite3' section of SKILL.md.
Sanitization: No sanitization or validation of the data being inserted into or read from the database is mentioned. If an attacker influences a profile being tracked (e.g., by changing their Twitter bio/activity), they could inject instructions that the agent would then execute when processing that influencer's record.

influencer-db