sql-explainer

Warn

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection and Cross-Site Scripting (XSS) because it processes untrusted user input and incorporates the results into a webview without sanitization.\n
  • Ingestion points: Untrusted user input enters the agent context via the SQL query provided by the user as described in SKILL.md.\n
  • Boundary markers: Absent. There are no delimiters or instructions provided to the agent to treat the SQL query as untrusted data or to ignore embedded instructions.\n
  • Capability inventory: The skill uses the run_js tool to execute scripts/index.html, which in turn opens assets/webview.html with data provided by the agent.\n
  • Sanitization: Absent. The webview implementation in assets/webview.html uses innerHTML to render the step1, step2, and step3 fields from the AI's response. This allows a malicious payload generated by the AI model (based on a crafted user query) to execute JavaScript within the context of the skill's webview.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 14, 2026, 08:23 AM
Security Audit — agent-trust-hub — sql-explainer