distributed sql
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including database query results via 'readonly_query' and externally-sourced SQL (e.g., pg_dump, ORM migrations, or user-pasted DDL) which are then processed by the agent to generate reports or execute further actions.
- Ingestion points: Database output from 'readonly_query', query plans from 'EXPLAIN ANALYZE', and user-provided SQL scripts processed by 'dsql_lint'.
- Boundary markers: The instructions mandate the use of 'safe_query.build()' to encapsulate inputs, which provides a structural boundary for SQL parameters.
- Capability inventory: The agent has the capability to execute write operations (DDL/DML) via the 'transact' tool and execute shell commands in fallback scenarios.
- Sanitization: The skill requires validation of all externally-sourced or generated DDL via the 'dsql_lint' tool and uses a custom library ('safe_query.build') for identifier and value escaping.
- [COMMAND_EXECUTION]: The skill provides instructions for a 'psql fallback' mechanism that involves executing shell commands to generate authentication tokens and interact with the database.
- Evidence: The fallback documentation in SKILL.md includes a bash code block using 'aws dsql generate-db-connect-admin-auth-token' and piping SQL into the 'psql' utility.
Audit Metadata