db-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell and SQL scripts designed to perform database audits. These scripts, such as
analyze-query-plan.sh,audit-missing-indexes.sql, andbloat-check.sql, are intended to be executed against a PostgreSQL environment to retrieve performance metrics, identify missing indexes, and check for table bloat. - [EXTERNAL_DOWNLOADS]: The documentation and research notes cite numerous external technical resources. These include official documentation from
postgresql.org,pgbouncer.org, andtimescale.com, as well as repositories and websites for well-known database platforms and tools like Supabase, Neon, Drizzle, and Prisma. These links are provided for informational and citation purposes. - [PROMPT_INJECTION]: The skill is designed to analyze existing database schemas and project files, which creates an attack surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read local files such as
schema.sql,package.json, and ORM schema files (schema.ts,schema.prisma) to perform reviews. - Boundary markers: The instructions do not specify the use of specific delimiters or "ignore embedded instructions" warnings when reading these files.
- Capability inventory: The skill has the capability to execute shell scripts (
analyze-query-plan.sh) and SQL commands viapsqlbased on its analysis. - Sanitization: There are no explicit sanitization or filtering steps defined for the content read from the database schema or configuration files.
Audit Metadata