data-seeding-fixtures-builder

Warn

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/reset-db.ts utilizes prisma.$executeRawUnsafe to execute dynamically generated SQL TRUNCATE commands for all tables in the public schema by iterating through table names fetched from the system catalog.\n- [PRIVILEGE_ESCALATION]: The database reset process employs the high-privilege PostgreSQL command SET session_replication_role = 'replica' to bypass foreign key constraints and triggers during the truncation phase, which is a powerful administrative operation.\n- [CREDENTIALS_UNSAFE]: A hardcoded password value (password123) is included in the Playwright test fixture example located in tests/fixtures/e2e.fixture.ts for simulating user authentication.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface in scripts/reset-db.ts where database metadata (table names from pg_tables) is ingested and passed to dynamic SQL execution tools (executeRawUnsafe) without sanitization or explicit boundary markers, combined with high-privilege capabilities.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 4, 2026, 09:30 AM
Security Audit — agent-trust-hub — data-seeding-fixtures-builder