planetscale-mcp-agent-operating-model
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes automation loops that ingest untrusted external data, creating a potential surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read and process external repository code, database schema recommendations, and Insights telemetry metrics (SKILL.md).
- Boundary markers: The skill establishes explicit 'Safe autonomous tasks' versus 'Not allowed' boundaries and defines multi-tier execution levels (Tier 1 and Tier 2) to isolate autonomous actions from production environments.
- Capability inventory: The agent is granted capabilities to create git branches, apply DDL and migrations to non-production development environments, open pull requests, and file tracking issues.
- Sanitization: The workflow mandates human review and approval gates ('Human reviews', 'Human approves') as the primary sanitization mechanism for any database-affecting actions generated from external data analysis.
Audit Metadata