server-query-optimizer
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-supplied SQL queries to perform performance analysis, creating an indirect prompt injection surface. (1) Ingestion points: User query strings describing slow performance in examples/examples.md. (2) Boundary markers: Absent; queries are processed directly for EXPLAIN plans. (3) Capability inventory: Execution of SQL++ commands and use of CLI tools across all scripts. (4) Sanitization: No explicit SQL validation rules are defined.
- [COMMAND_EXECUTION]: The skill utilizes database-specific CLI tools (cbq and couchbase-cli) to inspect indexes and manage cluster users in SKILL.md and references/index-ddl.md.
- [CREDENTIALS_UNSAFE]: Reference documentation for RBAC management contains generic example credentials (Administrator and password) within a CLI command example in references/index-ddl.md.
Audit Metadata