The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is configured to automatically search for and parse sensitive files such as bootstrap-dev.yml and .claude/mysql-config.json to extract database username and password values in plaintext.
[COMMAND_EXECUTION]: The skill invokes the mysql CLI by interpolating parameters like {password} and {SQL} directly into a shell command string: mysql -h {host} -P {port} -u {user} -p'{password}' {database} -e "{SQL}". This pattern is susceptible to shell injection if these variables contain metacharacters like backticks or subshell expansions.
[DATA_EXFILTRATION]: The skill's primary function is to read records from databases (including remote environments like prod) and display them to the agent. While it implements a command whitelist, it still enables the retrieval of sensitive data from the database into the conversation context.
[EXTERNAL_DOWNLOADS]: The skill checks for the presence of the mysql client and suggests installing it via brew install mysql-client from Homebrew, a well-known service, if the executable is missing.

mysql-debug