dbops-changeset

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow uses webFetch and webSearch to fetch arbitrary Liquibase documentation URLs during authoring and rule verification.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to fetch Liquibase documentation from docs.liquibase.com during runtime when uncertain about syntax, representing a common/reputable unofficial operational dependency on an external documentation site.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill generates and reviews database changesets (Liquibase YAML) and can trigger a pipeline execution (database_execute_llm_authoring_pipeline) via harness_execute under the "Accept & Commit" workflow. This pipeline execution initiates downstream database migration deployments, representing a direct financial operation (service cost/infrastructure/resource execution instruction). However, the skill only supports chat-based code generation, review, and tool-invocation formatting with no independent authentication, payment gateway credential handling, or secure server-side validation enforcing the financial/operational instruction independently of the agent's prompt flow. Since direct operations lack established independent access control in the supplied documentation, the risk level is high.