sqlcl-conn-mng
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
sqlcl-conn-mngCLI tool directly from the author's GitHub repository (https://github.com/s2005/sqlcl_conn_mng.git) using theuvtool manager. - [COMMAND_EXECUTION]: The skill operates by executing shell commands to interact with the globally installed
sqlcl-conn-mngutility for database connection lifecycle management. - [INDIRECT_PROMPT_INJECTION]: The skill processes connection strings and user metadata from a local project store, which serves as a potential vector for indirect prompt injection if the store contains malicious instructions.
- Ingestion points: Connection metadata read from the project's
.sqlcldirectory via theshowandlistcommands. - Boundary markers: The skill encourages the use of JSON output levels to structure data but does not specify delimiters for embedded strings.
- Capability inventory: The skill enables shell command execution and file system interaction within the project scope.
- Sanitization: The instructions emphasize metadata-only views (
showandlist) and discourage direct file access to minimize risk during data processing.
Audit Metadata