drizzle-orm-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata identifies the author as Basti Ortiz and points to a GitHub repository not associated with the primary vendor. This is noted as a typical metadata inconsistency for shared or forked documentation and does not represent a security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an instructional knowledge base for an AI agent.
- Ingestion points: The agent processes the provided markdown files to adopt Drizzle ORM conventions.
- Boundary markers: The skill uses clear markdown headers and specific code blocks for 'GOOD' and 'BAD' examples to provide context.
- Capability inventory: The skill does not request or use any dangerous capabilities such as direct shell execution, network operations, or arbitrary file-writing.
- Sanitization: The instructions explicitly promote the use of parameterization and runtime schema validation (e.g., via Valibot) to secure database interactions.
- [SAFE]: The skill explicitly recommends against unsafe practices like raw SQL concatenation and type assertion without validation, instead promoting secure ORM builders and runtime decoders to prevent SQL injection.
- [SAFE]: No malicious patterns, such as obfuscated URLs, remote code execution, or credential exfiltration, were identified in the files.
Audit Metadata