auditing-table-statistics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The bash scripts provided in the reference files (references/create-statistics-examples.md and references/statistics-thresholds.md) interpolate database object names fetched from the system schema directly into SQL commands. This creates an indirect prompt injection surface where a malicious actor capable of naming database objects could potentially influence the execution of these maintenance scripts.\n
- Ingestion points: Metadata is ingested from information_schema.tables and information_schema.columns in files references/create-statistics-examples.md and references/statistics-thresholds.md.\n
- Boundary markers: None. The scripts assume metadata strings are safe for direct interpolation.\n
- Capability inventory: The scripts utilize the cockroach CLI to execute SQL commands, manage jobs, and perform background processing.\n
- Sanitization: The scripts lack sanitization for variables interpolated into shell strings, such as in cockroach sql -e "CREATE STATISTICS auto FROM $table;".\n- [DYNAMIC_EXECUTION]: The skill documentation provides shell scripts that dynamically construct and execute SQL statements at runtime to facilitate batch operations.\n- [COMMAND_EXECUTION]: The skill includes operational scripts that execute system commands to interface with the database CLI, managing cluster maintenance tasks.
Audit Metadata