enforcing-password-policies
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill utilizes template placeholders like
<username>and<new-strong-password>which are intended to be replaced with user-supplied values before executing SQL commands. This creates a surface for potential SQL injection if the agent does not validate or escape the inputs provided by the user. - Ingestion points: User-provided values for placeholders in
SKILL.md(Steps 5, 6, 7) andreferences/sql-queries.md. - Boundary markers: None present in the instructions to delimit user input from the SQL command structure.
- Capability inventory: The skill utilizes administrative SQL commands including
ALTER USERandSET CLUSTER SETTING. - Sanitization: Not explicitly mentioned; the skill assumes the agent or user provides valid, safe strings for these identifiers.
Audit Metadata