databases
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python utility scripts (db_backup.py, db_migrate.py, db_performance_check.py) execute shell commands and SQL queries. db_backup.py uses subprocess to invoke database CLI tools like mongodump and pg_dump. This is the primary intended functionality.
- [EXTERNAL_DOWNLOADS]: SKILL.md and scripts/requirements.txt provide links and instructions for downloading official database client tools from well-known services like MongoDB and PostgreSQL.
- [DYNAMIC_EXECUTION]: db_migrate.py executes SQL code dynamically loaded from local migration JSON files. This is standard practice for schema migration tools.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from database logs and local migration files.
- Ingestion points: db_migrate.py (line 218) reads JSON migration files; db_performance_check.py (lines 144, 236) reads query strings from database logs.
- Boundary markers: Absent.
- Capability inventory: SQL execution and subprocess calls (db_backup.py line 67).
- Sanitization: Absent.
- Risk Assessment: This represents a low-risk attack surface typical of administrative database tools.
Audit Metadata