database-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to start a local database MCP server using the command
yarn --silent workspace metroscope-database-mcp start. This command executes a local package belonging to the skill's author context (metroscope-dev).- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by ingesting and processing results from external database queries.- Ingestion points: Data enters the agent context via the
query-postgresandquery-adxtool outputs defined inSKILL.md. - Boundary markers: The instructions do not explicitly provide delimiters or warnings to the agent to disregard instructions potentially embedded within the database query results.
- Capability inventory: The skill permits read-only SQL and KQL querying and local workspace command execution.
- Sanitization: The skill mandates the use of parameterized SQL queries (e.g.,
$1,$2) to prevent traditional SQL injection, which is a security best practice.
- Ingestion points: Data enters the agent context via the
Audit Metadata