spacetimedb-quickstarts
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the SpacetimeDB CLI by piping a remote script to the shell. Evidence:
curl -sSf https://install.spacetimedb.com | shinreferences/intro-faq.md. This is presented as the standard installation method for the official service tool.\n- [EXTERNAL_DOWNLOADS]: The quickstart guides reference installing external tools and dependencies, including the Emscripten SDK and various package managers. Evidence: Mentions ofemscripten.orginreferences/quickstarts-c-plus-plus.mdanddotnet workload install wasi-experimentalinreferences/quickstarts-c-sharp.md.\n- [COMMAND_EXECUTION]: The skill contains numerous examples of shell commands for thespacetimeCLI to initialize, build, and publish database modules. Evidence:spacetime dev,spacetime publish, andspacetime callcommands throughout the documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where user input is processed by database functions (reducers).\n - Ingestion points: Code snippets in quickstart references (e.g.,
references/quickstarts-typescript.md) show reducers likeaddtaking string arguments from client calls.\n - Boundary markers: The documentation in
references/intro-what-is-spacetimedb.mdexplicitly mentions Row Level Security (RLS) filters for access control.\n - Capability inventory: The skill demonstrates writing to database tables and defines procedures in
references/intro-key-architecture.mdwhich can perform HTTP requests.\n - Sanitization: Code examples utilize the platform's type-safe schema definitions to validate inputs.
Audit Metadata