pythia-tune

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill handles SQL statements sourced from code or user queries, creating a potential surface for indirect injection. (1) Ingestion points: SQL strings from pythia src, pythia grep, and user input in SKILL.md and reference/tuning-checklist.md. (2) Boundary markers: No delimiters or 'ignore' instructions are present. (3) Capability inventory: Uses pythia explain, pythia sql (execution), and pythia deploy. (4) Sanitization: Not specified in instructions.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute 'pythia' CLI commands and shell utilities like time. These are necessary for query tuning and performance measurement.
  • [SAFE]: The skill implements operational best practices, including checking for database licenses (AWR/ASH) and respecting schema ownership for administrative tasks like gathering statistics.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 04:55 AM