event-store-design
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, such as prompt injection, obfuscation, or unauthorized data exfiltration, were identified during the analysis of the skill instructions and resources.
- [COMMAND_EXECUTION]: The implementation templates for PostgreSQL utilize parameterized queries to prevent SQL injection when appending or reading events.
- Evidence: The code uses placeholders like
$1,$2withasyncpgto separate SQL logic from data input. - [DATA_EXPOSURE]: No hardcoded credentials or sensitive file paths were detected.
- Evidence: The skill provides a development-only EventStoreDB URI (
esdb://localhost:2113?tls=false) and explicitly warns users to implement authenticated TLS for remote connections. - [INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface for event-sourced systems. The provided Python and SQL templates follow secure coding practices by treating event data as structured JSON/JSONB.
- Evidence: Use of
json.dumps()for storage andjson.loads()for retrieval, alongside parameterized queries, ensures that untrusted event content is treated as data rather than executable logic.
Audit Metadata