database-migrations-migration-observability

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection through its ingestion of untrusted external data.
  • Ingestion points: Data is consumed from Kafka topics (e.g., database.changes) and MongoDB collections during migration monitoring.
  • Boundary markers: The instructions and scripts do not implement delimiters or specific warnings to ignore embedded instructions within the processed data streams.
  • Capability inventory: The skill possesses network capabilities via the requests library to send data to Slack, Grafana, and Kafka Connect, and file system write access for logging.
  • Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from external sources before it is interpolated into alerts or log files.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes several well-known and standard third-party libraries.
  • Node.js packages: Includes mongodb, winston, and prom-client for database connectivity and observability.
  • Python packages: Uses kafka-python, prometheus_client, requests, and numpy for data processing and telemetry.
  • GitHub Actions: Provides an example workflow utilizing the trusted actions/checkout@v4 action.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 08:29 PM
Security Audit — agent-trust-hub — database-migrations-migration-observability