sqlspec
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical instructions for an AI agent to use the sqlspec library. All described operations (SQL generation, adapter configuration, framework integration) are legitimate and consistent with the tool's primary purpose.
- [SAFE]: The documentation includes strong security guidance for preventing SQL injection, such as prohibiting string concatenation and recommending AST validation for user-supplied identifiers via sqlglot.
- [SAFE]: Usage of environment variables (e.g., VERTEX_AI_API_KEY) for secret management in AI integrations follows industry best practices and avoids hardcoding sensitive credentials.
- [SAFE]: Remote references, such as GitHub repositories for the litestar-org ecosystem, target official vendor sources and trusted well-known services (e.g., Google Cloud, Vercel, Cloudflare).
- [INDIRECT_PROMPT_INJECTION]: The skill inherently interacts with external data sources (databases), which constitutes a potential surface for indirect prompt injection. However, the skill implements multiple layers of safety, including parameterized queries and AST validation, and the documentation emphasizes these as mandatory patterns. The overall risk is categorized as safe given the library's design for security-conscious data access.
Audit Metadata