profiling-statement-fingerprints
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates entirely via SQL queries against CockroachDB internal statistics tables, which is the intended and documented way to profile statement performance.
- [SAFE]: Security is maintained by requiring the VIEWACTIVITY cluster privilege, ensuring that only authorized users can access the performance data.
- [PROMPT_INJECTION]: The skill includes an indirect prompt injection surface because it reads SQL query text from the database. Malicious instructions embedded in query strings could potentially influence the AI agent during analysis, though this is a standard risk for database monitoring tools.
Audit Metadata