seekdb

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONOBFUSCATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches configuration and resources from remote servers. • Downloads an installation script from the vendor's Alibaba Cloud S3 bucket (obportal.s3.ap-southeast-1.amazonaws.com). • Fetches the uv tool installer from astral.sh. • Downloads Miniconda from anaconda.com. • Retrieves a sample text file (state_of_the_union.txt) from an external GitHub repository (GITHUBear/langchain) for use in a tutorial.
  • [COMMAND_EXECUTION]: Benchmark and management scripts execute shell commands at runtime. • The TPC-H benchmarking module includes a Python script (load.py) that constructs and executes mysql load commands. • Deployment guides instruct users to run package management commands (e.g., apt, yum, rpm, brew) with elevated privileges.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides features to ingest data from CSV and Excel files into vector databases. • Ingestion points enter the database context via the cli tool and importing sub-skills. • Boundary markers are generally absent in the provided examples for sanitizing external file content before vectorization. • Capability inventory includes shell execution via SQL, network requests via AI models, and file system writes for exports. • Sanitization of external content before interpolation into vector storage or prompts is not explicitly documented.
  • [DYNAMIC_EXECUTION]: Benchmarking scripts generate and execute shell strings. • The load.py script for TPC-H dynamically constructs command strings using variable interpolation and executes them via commands.getstatusoutput.
  • [OBFUSCATION]: A tutorial for building a personal knowledge base contains a deep-link URL for the Cursor editor with a Base64-encoded configuration parameter. The encoded data (eyJjb21t...) decodes to a setup command for the seekdb-mcp-server tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:16 AM
Security Audit — agent-trust-hub — seekdb