pump-performance-db

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [SAFE]: The skill is a legitimate engineering tool for pump data management and analysis. All code samples are provided as clear, educational templates without any hidden or suspicious functionality.\n- [COMMAND_EXECUTION]: The skill uses the sqlite3 library for local data storage. All database interactions utilize parameterized queries (e.g., cursor.execute('... VALUES (?)', (val,))), which is the industry standard for preventing SQL injection attacks.\n- [EXTERNAL_DOWNLOADS]: The skill references official manufacturer domains (e.g., grundfos.com, ksb.com) and well-known engineering tools (e.g., WebPlotDigitizer at automeris.io). These references are used for data acquisition and selection purposes and do not involve the execution of remote scripts.\n- [DATA_EXFILTRATION]: There are no signs of credential harvesting, unauthorized access to sensitive system files (e.g., .ssh, .aws), or code designed to exfiltrate private user information.\n- [SAFE]: The skill features a data ingestion surface (parsing PDFs and web scraping), but includes a comprehensive 'Data Validation Checklist' and does not possess capabilities that could be exploited via indirect prompt injection (e.g., no arbitrary command execution or dynamic code evaluation).
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 11:23 PM
Security Audit — agent-trust-hub — pump-performance-db