mdsql
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests installing the
mdsqlpackage from NPM if the tool is not found on the system. This package is an official resource from the skill author. - [COMMAND_EXECUTION]: The agent is instructed to use the
mdsqlCLI to perform various tasks such as listing queries, running SQL queries, and managing the local cache. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from markdown frontmatter in the user's workspace. While this is a potential attack surface for indirect prompt injection, the skill explicitly mentions using SQL placeholders (
?) for named queries to bind parameters securely, which follows security best practices.
Audit Metadata