database
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
executeSqltool allows the agent to fetch data from various external database targets, which is then processed as part of the agent's context. This presents an attack surface where malicious instructions embedded in database records could influence the agent's behavior. - Ingestion points: Output from the
executeSqlfunction, which can target PostgreSQL, BigQuery, Databricks, or Snowflake databases. - Boundary markers: The skill lacks explicit instructions or delimiters for the agent to differentiate between its own instructions and untrusted data retrieved from the database.
- Capability inventory: The skill provides significant capabilities, including the ability to provision new databases (
createDatabase), modify data in development environments (executeSql), and access sensitive connection strings and credentials. - Sanitization: There is no evidence of sanitization or filtering applied to the query results before they are presented to the agent's reasoning engine.
Audit Metadata