powersync
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
powersyncCLI tool to manage Cloud and self-hosted instances, deploy configurations, and perform diagnostics. This is a core feature of the skill. - [DYNAMIC_EXECUTION]: The skill includes a maintenance script (
scripts/trim.mjs) used to remove reference files for unused platforms. The agent is instructed to run this script only with explicit operator approval. The script performs file read, write, and delete operations strictly within the skill's own installation directory. - [PERSISTENCE]: The skill proposes adding a pointer line to the project's agent context files (e.g.,
AGENTS.mdorCLAUDE.md) to ensure the PowerSync skill is loaded in subsequent sessions. - [INDIRECT_PROMPT_INJECTION]: The skill provides guidance on handling untrusted data from sync streams. It correctly identifies the risk of client-supplied parameters and recommends using server-side auth guards (
auth.user_id()) to ensure secure data access.
Audit Metadata