embedded-sql
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a documentation and best-practices guide for Protheus/ADVPL developers. It promotes the use of Embedded SQL (BeginSQL/EndSQL) specifically to prevent SQL injection and improve code maintainability.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided code and SQL queries, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: User requests for writing, reviewing, or migrating SQL code as specified in SKILL.md.
- Boundary markers: No explicit delimiters are provided in the instructions to isolate user input from the agent's logic.
- Capability inventory: The agent is tasked with generating and reviewing code, which involves capabilities for file interaction and instruction processing.
- Sanitization: The skill mandates the use of %exp% macros to sanitize SQL variables, effectively mitigating injection risks within the generated code context.
Audit Metadata