prisma-orm

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides standard documentation for installing the Prisma CLI and its associated client and driver libraries from the official npm registry.
  • [EXTERNAL_DOWNLOADS]: The maintenance script scripts/check-updates.py fetches the latest version information for @prisma/client from the official npm registry (registry.npmjs.org) to notify the user of updates.
  • [COMMAND_EXECUTION]: The documentation includes routine usage of the Prisma CLI tool via npx for tasks such as project initialization, client code generation, and database migration deployment.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting data from external databases and processing schema definitions.
  • Ingestion points: Untrusted data enters the context through database query results and raw SQL execution documented in references/03-client-crud.md and references/07-raw-queries.md.
  • Boundary markers: The Prisma ORM provides boundaries through its API abstraction; the documentation also explicitly promotes the use of tagged template literals for raw queries to separate code from data.
  • Capability inventory: The skill utilizes CLI-driven subprocess calls for file system writes (npx prisma generate) and database schema modifications (npx prisma migrate).
  • Sanitization: The documentation provides specific guidance on preventing SQL injection by warning against the use of $queryRawUnsafe with untrusted input and recommending parameterized queries instead.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:30 AM
Security Audit — agent-trust-hub — prisma-orm