spacetimedb-quickstarts

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the SpacetimeDB CLI by piping a remote script to the shell. Evidence: curl -sSf https://install.spacetimedb.com | sh in references/intro-faq.md. This is presented as the standard installation method for the official service tool.\n- [EXTERNAL_DOWNLOADS]: The quickstart guides reference installing external tools and dependencies, including the Emscripten SDK and various package managers. Evidence: Mentions of emscripten.org in references/quickstarts-c-plus-plus.md and dotnet workload install wasi-experimental in references/quickstarts-c-sharp.md.\n- [COMMAND_EXECUTION]: The skill contains numerous examples of shell commands for the spacetime CLI to initialize, build, and publish database modules. Evidence: spacetime dev, spacetime publish, and spacetime call commands throughout the documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where user input is processed by database functions (reducers).\n
  • Ingestion points: Code snippets in quickstart references (e.g., references/quickstarts-typescript.md) show reducers like add taking string arguments from client calls.\n
  • Boundary markers: The documentation in references/intro-what-is-spacetimedb.md explicitly mentions Row Level Security (RLS) filters for access control.\n
  • Capability inventory: The skill demonstrates writing to database tables and defines procedures in references/intro-key-architecture.md which can perform HTTP requests.\n
  • Sanitization: Code examples utilize the platform's type-safe schema definitions to validate inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:23 AM