sql-pro

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and process untrusted external data including query goals, database schemas, and workload descriptions.
  • Ingestion points: The argument-hint field in SKILL.md and the Phase 1 workflow explicitly instruct the agent to process external query goals and schema details.
  • Boundary markers: The instructions do not define clear boundary markers (such as XML tags or triple backticks) to separate user-provided data from system instructions, nor do they include warnings to ignore instructions embedded within the processed data.
  • Capability inventory: The skill is restricted to the Read tool in its frontmatter, which significantly limits the potential impact of a successful injection compared to skills with write or network access.
  • Sanitization: There are no defined procedures for validating or escaping external content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 01:53 PM
Security Audit — agent-trust-hub — sql-pro