database-migrations-sql-migrations
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
rollback_migration.shscript template inresources/implementation-playbook.mddirectly interpolates shell variables ($DATABASEand$MIGRATION_VERSION) into sensitive commands such aspsqlandpg_dump. This pattern allows for arbitrary command injection if the inputs are controlled by a user or an external source. - [COMMAND_EXECUTION]: Multiple Python examples in
resources/implementation-playbook.md, including theParallelMigratorandvalidate_post_migrationfunctions, use f-strings to insert table and column names into SQL queries. This practice introduces SQL injection vulnerabilities because database identifiers are not properly sanitized or handled via safe identifier composition APIs.
Recommendations
- AI detected serious security threats
Audit Metadata