planetscale-autonomous-execution-mode
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external data sources, including operator messages and recommendation reports, which could potentially be manipulated to influence agent behavior.
- Ingestion points: The agent processes user input for the 'Activation contract' (SKILL.md) and external recommendation reports ('All recommendations in the report') to determine its execution plan.
- Boundary markers: The skill implements strong boundary markers by requiring specific, unambiguous 'Explicit risk acknowledgment' phrases and named scopes before activating autonomy.
- Capability inventory: The agent is authorized to perform database mutations, including DDL changes, branch management, and deployment operations across defined database environments.
- Sanitization: The protocol mandates 'Pre-flight' checks to verify live state matches evidence and post-step verification to ensure commands achieved the expected state before proceeding.
- [COMMAND_EXECUTION]: The skill facilitates the end-to-end execution of database commands and infrastructure changes.
- The execution is bounded by a 'Class' system (B, C, D) and explicitly prohibits 'Class E' operations (e.g., dropping production tables or exposing secrets), even if requested by an authorized user.
- Autonomous execution is limited to the 'named scope only', preventing the agent from performing actions discovered mid-run without further authorization.
Audit Metadata