prisma-orm
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides standard documentation for installing the Prisma CLI and its associated client and driver libraries from the official npm registry.
- [EXTERNAL_DOWNLOADS]: The maintenance script
scripts/check-updates.pyfetches the latest version information for@prisma/clientfrom the official npm registry (registry.npmjs.org) to notify the user of updates. - [COMMAND_EXECUTION]: The documentation includes routine usage of the Prisma CLI tool via
npxfor tasks such as project initialization, client code generation, and database migration deployment. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting data from external databases and processing schema definitions.
- Ingestion points: Untrusted data enters the context through database query results and raw SQL execution documented in
references/03-client-crud.mdandreferences/07-raw-queries.md. - Boundary markers: The Prisma ORM provides boundaries through its API abstraction; the documentation also explicitly promotes the use of tagged template literals for raw queries to separate code from data.
- Capability inventory: The skill utilizes CLI-driven subprocess calls for file system writes (
npx prisma generate) and database schema modifications (npx prisma migrate). - Sanitization: The documentation provides specific guidance on preventing SQL injection by warning against the use of
$queryRawUnsafewith untrusted input and recommending parameterized queries instead.
Audit Metadata