database-migration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for reading and transforming database records, which presents an ingestion surface for untrusted data.\n
- Ingestion points: Data is fetched via database queries (e.g.,
SELECT id, address_string FROM usersinSKILL.md).\n - Boundary markers: No explicit instructions to the agent to ignore instructions embedded within the database data are present.\n
- Capability inventory: The skill utilizes shell scripts (
scripts/test-migration.sh), Python scripts (assets/data-migration-script.py), and direct database query execution capabilities.\n - Sanitization: While code snippets use parameterized queries for SQL safety, there is no verification or sanitization of the data content for potential prompt injection attacks.\n- [COMMAND_EXECUTION]: The skill involves the execution of migration-related shell scripts and standard ORM command-line interfaces.\n
- Evidence: References
scripts/test-migration.shand provides examples usingnpx sequelize-cli,npm run typeorm, andnpx prisma.
Audit Metadata