sql-expert
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes
scripts/sql_helper.py, which utilizes SQLAlchemy to execute SQL queries. This is a functional requirement for the skill's purpose and is implemented using standard database connection patterns. - [PROMPT_INJECTION]: The skill instructions and reference materials (
references/best-practices.md,references/common-pitfalls.md) explicitly prioritize the use of parameterized queries to mitigate SQL injection risks, demonstrating a security-first approach to query design. - [EXTERNAL_DOWNLOADS]: The documentation suggests installing standard, well-known database drivers (
psycopg2-binary,sqlalchemy,mysql-connector-python,pyodbc) from the official Python Package Index (PyPI). - [SAFE]: Indirect Prompt Injection Surface Evaluation: 1. Ingestion points: User requirements and SQL snippets provided to the agent in the context of database tasks. 2. Boundary markers: Absent. 3. Capability inventory: SQL execution via
scripts/sql_helper.py. 4. Sanitization: Detailed instructions and best practices for using parameterized queries are provided to the agent to prevent exploitation of the execution capability.
Audit Metadata