tidbx-prisma
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the user to execute standard development commands like npm install, npx prisma, and npx ts-node. These are routine operations for setting up a Node.js development environment and an ORM.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a potential attack surface by ingesting database data via an ORM (Ingestion point: templates/quickstart.ts). While specific boundary markers are absent in the code templates, the capabilities are limited to database CRUD, and the skill provides sanitization by recommending parameterized queries using Prisma template literals ($queryRaw).
- [DYNAMIC_EXECUTION]: The skill provides TypeScript templates (quickstart.ts, validate_connection.ts) designed for execution via ts-node. These scripts perform standard database connectivity tests and CRUD tasks that are consistent with the skill's primary purpose.
- [CREDENTIALS_UNSAFE]: The documentation includes example connection strings for TiDB that use clear placeholders (e.g., USER:PASSWORD). The skill follows security best practices by correctly emphasizing the use of environment variables for managing actual database credentials.
Audit Metadata