mysql
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains a shell script
scripts/mysql_diag.shthat invokes themysqlcommand-line utility to collect database metadata. The script utilizes environment variables for authentication and executes static SQL commands to retrieve configuration settings such as SQL modes, engine defaults, and slow query log parameters.\n- [INDIRECT_PROMPT_INJECTION]: The skill relies on analyzing the output from database diagnostic commands to differentiate between MySQL and TiDB backends and to provide performance advice, establishing an indirect prompt injection attack surface.\n - Ingestion points: Output from the
mysql_diag.shdiagnostic script and SQL results from queries likeSELECT VERSION()andSHOW ENGINES.\n - Boundary markers: The skill does not define explicit boundary markers or instruction-ignore wrappers for data ingested from the database client.\n
- Capability inventory: The skill possesses the capability to execute shell commands (via the diagnostic script) and arbitrary SQL queries provided by the user.\n
- Sanitization: The skill documentation enforces the use of prepared statements and parameterized queries as a core guardrail to mitigate SQL injection and related risks.
Audit Metadata