Elastic elasticsearch-esql — agentic threat model

Not certain from the listing — relies on an unspecified foundation model. The primary threat is prompt injection forcing the model to generate malicious ES|QL queries (e.g., data exfiltration or resource exhaustion) that are then executed on the cluster.

The agent interacts directly with Elasticsearch cluster data via ES|QL. Threats include unauthorized data exfiltration, exposure of sensitive index schemas, and potential poisoning of search results if the agent is used to write or modify index data.

The agent framework orchestrates query generation and execution. The primary vulnerability is insecure tool integration, specifically the execution tool that runs raw ES|QL queries against the user's cluster without sufficient validation or sanitization.

Not certain from the listing — deployment details of the agent skill are unspecified. If hosted insecurely, threats include exposure of Elasticsearch API keys, credentials, or connection strings used to access the target clusters.

Not certain from the listing — there is no mention of built-in guardrails, query validation, or execution logging. Gaps here could allow malicious or highly inefficient queries to run undetected, causing denial of service on the cluster.

The agent's security posture depends heavily on the Elasticsearch cluster's native Role-Based Access Control (RBAC). If the agent runs with excessive privileges, it inherits those rights, risking compliance violations and unauthorized data access.

As an isolated Agent Skill, there is minimal multi-agent interaction described. The primary ecosystem risk is the potential for other upstream agents to call this skill to maliciously query or manipulate the underlying Elasticsearch cluster.