files-as-database

Pass

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is purely instructional and provides patterns for choosing between files and SQLite for state management. It contains no malicious code or instructions.
  • [DATA_EXFILTRATION]: The documentation identifies directory traversal risks when accessing the filesystem and provides specific regex-based sanitization logic to protect sensitive files like .env from unauthorized access.
  • [COMMAND_EXECUTION]: The skill describes standard application maintenance workflows using database scripts (db-query, db-exec) via pnpm for legitimate data management tasks.
  • [REMOTE_CODE_EXECUTION]: The skill advocates for the use of Drizzle ORM as a primary defense against SQL injection, ensuring that untrusted user data is handled safely without being executed as raw database commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 26, 2026, 06:44 AM
Security Audit — agent-trust-hub — files-as-database