dbmap
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the 'repomap' helper tool from the author's GitHub repository (https://github.com/ariadoss/repomap.git).
- [COMMAND_EXECUTION]: Executes a shell script (run.sh) from the downloaded repository to perform database mapping and analysis. It may also install the 'tbls' tool via Homebrew or Go.
- [CREDENTIALS_UNSAFE]: Scans for and reads sensitive database connection strings from local files such as .env, docker-compose.yml, and framework-specific configuration settings.
- [INDIRECT_PROMPT_INJECTION]: Scans application source code (ORM calls and SQL strings) to identify query patterns and generate index recommendations. Ingestion points: Reads source code files. Boundary markers: None. Capability inventory: Executes scripts, writes to DBMAP.md, and modifies CLAUDE.md. Sanitization: None.
Audit Metadata