role-permission-table-builder
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided role and resource definitions to generate security-sensitive code, creating a surface where malicious input could influence the generated logic.
- Ingestion points: User-defined role hierarchies and permission mappings processed according to instructions in
SKILL.md. - Boundary markers: The instructions do not define explicit delimiters or warnings to ignore embedded instructions within the processed data.
- Capability inventory: The skill generates SQL schemas, TypeScript middleware, and utilizes local Python scripts (
scripts/*.py) to write documentation and data seeds. - Sanitization: No explicit data validation or sanitization logic is described for the role/resource identifiers before they are interpolated into code templates.
- [DYNAMIC_EXECUTION]: The skill facilitates the generation of executable authorization code and database structures based on dynamic user requirements.
- Script generation: Produces TypeScript middleware and SQL DDL statements using provided implementation templates.
- Dynamic loading: Employs multiple local Python scripts (e.g.,
scripts/generate_permission_matrix.py,scripts/generate_rbac_schema.py) to perform complex data processing and generation tasks at runtime.
Audit Metadata