database-security
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional material and code examples for database security best practices. The provided SQL and TypeScript snippets for Supabase and Convex environments follow industry-standard security patterns, such as wrapping auth functions in subselects for RLS performance and enforcing identity validation in server functions.
- [NO_CODE]: The skill consists entirely of markdown documentation and reference materials. It contains no executable scripts, binaries, or automated configuration files that interact with the host system or network directly.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines an audit protocol that involves querying database metadata (e.g., pg_tables, information_schema). While this represents a potential surface for indirect prompt injection if an attacker controls database metadata, the risk is considered low as the instructions are focused on structural security analysis and the skill operates as a static reference guide.
Audit Metadata