The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): Hardcoded PostgreSQL credentials ('user:pass') are found in the DATABASES configuration within references/alembic-advanced.md.
[COMMAND_EXECUTION] (HIGH): The script scripts/create-migration.md utilizes shell interpolation (!) to execute local system commands such as git diff, alembic current, and date.
[PROMPT_INJECTION] (HIGH): Vulnerability to indirect prompt injection in scripts/create-migration.md via the $ARGUMENTS parameter. 1. Ingestion points: The $ARGUMENTS variable is interpolated directly into the generated Python file. 2. Boundary markers: Absent; the variable is placed inside a triple-quoted Python docstring ("""$ARGUMENTS..."""). 3. Capability inventory: The resulting file is a Python script intended for execution by the Alembic migration runner, providing a direct path to code execution. 4. Sanitization: None. An attacker can use triple quotes to escape the docstring and inject arbitrary Python commands.
[COMMAND_EXECUTION] (MEDIUM): Potential SQL injection in scripts/migration-template.py. The _add_not_null_column_safely helper function uses f-strings to interpolate the table and column parameters into SQL statements, which is unsafe for database identifiers.

alembic-migrations