planetscale-mcp-agent-operating-model
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing agents to ingest external data and perform automated actions based on that data.
- Ingestion points: PlanetScale MCP (Insights, schema recommendations, metadata, webhooks, traffic control) and repository code as mentioned in SKILL.md.
- Boundary markers (absent): The skill does not define specific boundary markers or delimiters for separating external data from instructions, although it does establish organizational approval gates.
- Capability inventory: Subprocess execution for 'pscale' CLI tools, creating and deleting branches, applying DDL/migrations to non-production branches, opening pull requests, and database read queries via 'planetscale_execute_read_query' in SKILL.md.
- Sanitization (absent): The skill lacks explicit instructions for sanitizing or validating external recommendations before interpolation.
- [COMMAND_EXECUTION]: The skill uses the PlanetScale CLI tool to gather configuration and execute database-related tasks.
- Evidence: Commands such as 'pscale agent-guide --format json' and 'pscale sql' are explicitly referenced in SKILL.md for automation.
- [EXTERNAL_DOWNLOADS]: The skill references technical documentation and guidance hosted on the official PlanetScale GitHub repository.
- Evidence: Links to the 'planetscale/cli' repository (https://github.com/planetscale/cli) in SKILL.md.
- [SAFE]: The skill implements a security-conscious framework that defaults to read-only scopes, explicitly lists prohibited production mutations, and requires human-in-the-loop review for state-changing operations.
Audit Metadata